CVE-2022-37164

Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.

• CWE-287
• CWE-916

• https://cwe.mitre.org/data/definitions/521.htmlThird Party Advisory
• https://cwe.mitre.org/data/definitions/916.htmlThird Party Advisory
• https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/Third Party Advisory
• https://github.com/inoda/ontrack/issues/78Issue Tracking, Third Party Advisory
• https://cwe.mitre.org/data/definitions/521.htmlThird Party Advisory
• https://cwe.mitre.org/data/definitions/916.htmlThird Party Advisory
• https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/Third Party Advisory
• https://github.com/inoda/ontrack/issues/78Issue Tracking, Third Party Advisory

Published

Sep 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37159Claroline 13.5.7 and prior is vulnerable to Remote code exec…9.8
• CVE-2022-3716A vulnerability classified as problematic was found in Sourc…5.4
• CVE-2022-37160Claroline 13.5.7 and prior allows an authenticated attacker …5.4
• CVE-2022-37161Claroline 13.5.7 and prior is vulnerable to Cross Site Scrip…6.1
• CVE-2022-37162Claroline 13.5.7 and prior is vulnerable to Cross Site Scrip…5.4
• CVE-2022-37163Bminusl IHateToBudget v1.5.7 employs a weak password policy …9.8
• CVE-2022-3717Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-37172Incorrect access control in the install directory (C:\msys64…7.8
• CVE-2022-37173An issue in the installer of gvim 9.0.0000 allows authentica…7.8
• CVE-2022-37175Tenda ac15 firmware V15.03.05.18 httpd server has stack buff…9.8
• CVE-2022-37176Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below cont…9.8
• CVE-2022-37177HireVue Hiring Platform V1.0 suffers from Use of a Broken or…7.5