Weakness (CWE)
CWE-547: Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
How to prevent it (1 mitigation)
-
Implementation
Avoid using hard-coded constants. Configuration files offer a more flexible solution.
Source: MITRE CWE-547
4 results · Clear filters · Feed
-
Medium 6.3
Keylime: keylime: security bypass due to hardcoded tpm quote nonce
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quot…
-
Medium 6.9
Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
-
Medium 5.6
Hardcoding sensitive information
Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. The seed string for the encrypt key was hardcoding. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report f…
-
Medium 6.1
Bypassing Sanitization using DOM clobbering in html-janitor
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.