Fallos del tipo CWE-256

215 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2023-50956MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.4%CVE-2026-42151HIGHPrometheus Azure AD remote write OAuth client secret exposed via config APIEPSS 0.4%CVE-2025-13221MEDIUMIntelbras UnniTI usuarios.xml credentials storageEPSS 0.4%CVE-2025-1709MEDIUMCVE-2025-1709EPSS 0.3%CVE-2024-55026HIGHAn issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrarEPSS 0.3%CVE-2024-4232MEDIUMPassword Storage in Plaintext Vulnerability in Digisol RouterEPSS 0.3%CVE-2024-3624HIGHMirror-registry: database user and password stored in plain-textEPSS 0.3%CVE-2024-3625HIGHMirror-registry: redis password stored in plain-textEPSS 0.3%CVE-2025-2500CRITICALA vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gaiEPSS 0.3%CVE-2025-61680MEDIUMMinecraft RCON Terminal: Plain Text Password Storage in ConfigurationEPSS 0.3%CVE-2025-53664MEDIUMJenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the JeEPSS 0.3%CVE-2021-47961HIGHA plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence EPSS 0.3%CVE-2023-3395MEDIUM ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files EPSS 0.3%CVE-2026-6597MEDIUMlangflow-ai langflow Flow Using API core.py has_api_terms credentials storageEPSS 0.3%CVE-2022-43958HIGHA vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are EPSS 0.3%CVE-2025-53655MEDIUMJenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potenEPSS 0.3%CVE-2018-25396HIGHHeatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htmEPSS 0.3%CVE-2025-31724MEDIUMJenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files EPSS 0.3%CVE-2025-25985LOWAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execEPSS 0.3%CVE-2023-4400MEDIUM A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and cEPSS 0.3%