Fallos del tipo CWE-256

215 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2019-19105MEDIUMABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentialsEPSS 0.3%CVE-2025-53675MEDIUMJenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they EPSS 0.3%CVE-2026-35556CRITICALPlaintext storage of a password in OpenPLC_V3EPSS 0.3%CVE-2018-7515—In Omron CX-Supervisor Versions 3.30 and prior, access of uninitialized pointer vulnerabilities can be exploited when CX Supervisor indirectEPSS 0.3%CVE-2022-3261MEDIUMPlain-text passwords saved in /var/log/messagesEPSS 0.3%CVE-2022-33928MEDIUMDell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges coulEPSS 0.3%CVE-2025-53662MEDIUMJenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins contrEPSS 0.3%CVE-2022-0555HIGHSubiquity Shows Guided Storage Passphrase in Plaintext with Read-all PermissionsEPSS 0.3%CVE-2022-3644MEDIUMThe collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write modEPSS 0.3%CVE-2023-43777MEDIUMInsecure storage of password in easySoftEPSS 0.3%CVE-2025-15128MEDIUMZKTeco BioTime Endpoint safe_setting credentials storageEPSS 0.3%CVE-2023-39227MEDIUM​Softneta MedDream PACS Plaintext Storage of a PasswordEPSS 0.3%CVE-2025-9982MEDIUMHard-coded admin credentials in Quick.CMSEPSS 0.3%CVE-2025-53665MEDIUMJenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration forEPSS 0.3%CVE-2025-33079MEDIUMIBM Controller information disclosureEPSS 0.3%CVE-2020-37115HIGHGUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password StorageEPSS 0.3%CVE-2026-46513HIGHFrogman: API tokens stored in plaintextEPSS 0.3%CVE-2021-1126MEDIUMCisco Firepower Management Center Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-14183MEDIUMSGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storageEPSS 0.3%CVE-2020-1669MEDIUMJunos OS: NFX350: Password hashes stored in world-readable formatEPSS 0.3%