Fallos del tipo CWE-256

215 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2024-5960CRITICALPlaintext Storage of a Password in Eliz Software's PanelEPSS 0.4%CVE-2023-26204LOWA plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versionEPSS 0.4%CVE-2020-25184HIGHRockwell Automation ISaGRAF5 Runtime Unprotected Storage of CredentialsEPSS 0.4%CVE-2024-3623MEDIUMMirror-registry: default database secret key stored in plain-text on initial configuration fileEPSS 0.4%CVE-2023-42493HIGH EisBaer Scada - CWE-256: Plaintext Storage of a PasswordEPSS 0.4%CVE-2025-5893CRITICALHonding Technology Smart Parking Management System - Exposure of Sensitive InformationEPSS 0.4%CVE-2024-40116HIGHAn issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html,EPSS 0.4%CVE-2025-56527HIGHPlaintext password storage in Kotaemon 0.11.0 in the client's localStorage.EPSS 0.4%CVE-2023-48700MEDIUMClear Text Credentials Exposed via Onboarding TaskEPSS 0.4%CVE-2024-41336HIGHDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior EPSS 0.4%CVE-2023-2633MEDIUMAPI keys stored and displayed in plain text by Code Dx Plugin EPSS 0.4%CVE-2024-25138MEDIUMAutomationDirect C-MORE EA9 HMI Plaintext Storage of a PasswordEPSS 0.4%CVE-2023-41610HIGHVicture PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.EPSS 0.4%CVE-2024-4425MEDIUMStoring credentials in plaintext in CemiParkEPSS 0.4%CVE-2025-15624CRITICALPlaintext Storage of a Password in Sparx Pro Cloud Server.EPSS 0.4%CVE-2025-5760MEDIUMSimple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective ModeEPSS 0.4%CVE-2024-28782MEDIUMIBM QRadar Suite Software information disclosureEPSS 0.4%CVE-2026-33216HIGHNATS has MQTT plaintext password disclosureEPSS 0.4%CVE-2025-7357HIGHPlaintext Storage of a Password in LITEON IC48A and IC80A EV ChargersEPSS 0.4%CVE-2025-53656MEDIUMJenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in jobEPSS 0.4%