Common Weakness Enumeration
CWE-547 Use of Hard-coded, Security-relevant Constants
Description
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-547 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-q8w6-w55c-ccv5 | CVE-2026-6420 | MODERATE |
Keylime has a hardcoded attestation challenge nonce that allows replay attacks |
2026-05-11 | |
| GHSA-j752-cjcj-w847 | CVE-2025-30206 | CRITICAL |
Dpanel's hard-coded JWT secret leads to remote code execution |
2025-04-23 | |
| GHSA-cf8f-w2c5-p5jr | CVE-2019-14837 | CRITICAL |
keycloak vulnerable to unauthorized login via mail server setup |
2023-11-06 | |
| GHSA-fx46-whrj-73v5 | CVE-2017-0928 | MODERATE |
Bypassing Sanitization using DOM clobbering in html-janitor |
2023-09-12 | |
| GHSA-w7qg-j435-78qw | CVE-2023-1712 | CRITICAL |
Use of hard-coded, security-relevant constants in deepset-ai/haystack |
2023-04-06 |