Weaknesses of type CWE-798

855 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2022-26138CRITICALThe Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users gEPSS 98.2%KEVCVE-2024-3272CRITICALD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentialsEPSS 98.0%KEVCVE-2019-15975CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilitiesEPSS 96.4%CVE-2024-28987CRITICALSolarWinds Web Help Desk Hardcoded Credential VulnerabilityEPSS 93.2%KEVCVE-2019-15976CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilitiesEPSS 92.8%CVE-2020-8657CRITICALAn issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php fEPSS 91.9%KEVCVE-2019-1935CRITICALCisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials VulnerabilityEPSS 83.4%CVE-2024-3408CRITICALAuthentication Bypass and RCE in man-group/dtaleEPSS 78.0%CVE-2022-28810MEDIUMZoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commandEPSS 71.0%KEVCVE-2023-22463CRITICALKubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token EPSS 69.7%CVE-2023-5074CRITICALAuthentication Bypass in D-Link D-View 8EPSS 67.9%CVE-2021-22707—A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlinEPSS 64.6%CVE-2023-28503CRITICALAuthentication bypass in UniRPC's udadmin serviceEPSS 62.1%CVE-2025-34509HIGHSitecore XM and XP Hardcoded CredentialsEPSS 53.9%CVE-2025-14611HIGHGladinet CentreStack and TrioFox Hard Coded AES KeysEPSS 50.9%KEVCVE-2018-15439CRITICALCisco Small Business Switches Privileged Access VulnerabilityEPSS 49.7%CVE-2022-38420HIGHAdobe ColdFusion Use of Hard-coded Credentials Application denial-of-serviceEPSS 44.0%CVE-2019-15977CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilitiesEPSS 38.1%CVE-2016-5645HIGHRockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hEPSS 29.6%CVE-2025-68926CRITICALRustFS has a gRPC Hardcoded Token Authentication BypassEPSS 29.0%