Weaknesses of type CWE-256

215 results

Senha codificada ou armazenamento em texto plano

É quando a senha ou credencial fica gravada direto no código-fonte, arquivo de configuração ou banco de dados sem criptografia. Qualquer um com acesso ao código, binário ou logs consegue ler a senha e comprometer sistemas. O risco aumenta exponencialmente se o código for versionado, distribuído ou ficar exposto em repositórios públicos.

Example

Um desenvolvedor escreve 'password = "admin123"' em uma variável de conexão ao banco, ou deixa credenciais de API em um arquivo .env commitado no Git. Um atacante clona o repositório ou decompila a aplicação e já tem acesso a sistemas críticos.

How to mitigate

Armazene senhas em gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault), use variáveis de ambiente seguras, nunca commite credenciais no versionamento, e implemente rotação automática de senhas. Em bancos de dados, sempre aplique hash com salt (bcrypt, Argon2) em vez de armazenar em texto plano.

CVE-2024-28736HIGHAn issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function.EPSS 2.5%CVE-2019-10921—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of passwords in the proEPSS 2.4%CVE-2017-16714—In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible withoutEPSS 2.4%CVE-2024-26165HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 1.9%CVE-2020-8183—A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.EPSS 1.9%CVE-2020-6961—In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XEPSS 1.6%CVE-2020-10609—Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system seEPSS 1.5%CVE-2018-7510—In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords areEPSS 1.4%CVE-2018-8851CRITICALEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versionsEPSS 1.3%CVE-2024-29978MEDIUMUser passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump fiEPSS 1.3%CVE-2017-6049—Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL.EPSS 1.3%CVE-2019-6518—Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.EPSS 1.2%CVE-2017-7913—A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3EPSS 1.2%CVE-2023-0457HIGHInformation Disclosure Vulnerability in MELSEC SeriesEPSS 1.2%CVE-2020-5374HIGHDell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptoEPSS 1.0%CVE-2021-32978HIGHAutomation Direct CLICK PLC CPU Modules Plaintext Storage of a PasswordEPSS 1.0%CVE-2021-1589MEDIUMCisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure VulnerabilityEPSS 1.0%CVE-2020-26079MEDIUMCisco IoT Field Network Director Unprotected Storage of Credentials VulnerabilityEPSS 1.0%CVE-2025-27656CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2EPSS 0.9%CVE-2024-43659HIGHPlaintext default credentials in firmwareEPSS 0.8%