Fallos del tipo CWE-256

215 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2025-53677MEDIUMJenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential forEPSS 0.3%CVE-2025-0936MEDIUMOn affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possiblyEPSS 0.3%CVE-2025-53674MEDIUMJenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, inEPSS 0.3%CVE-2024-43186MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.3%CVE-2024-28971LOWDell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high prEPSS 0.3%CVE-2026-23797MEDIUMPlaintext password display in Quick.CartEPSS 0.2%CVE-2025-45702MEDIUMSoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.EPSS 0.2%CVE-2025-52164HIGHSoftware GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.EPSS 0.2%CVE-2025-46809MEDIUMMulti Linux Manager epxoses the plain text HTTP Proxy user:password in logsEPSS 0.2%CVE-2026-40430HIGHPlaintext Storage of a Password in Panduit IntraVUE by PronetiqsEPSS 0.2%CVE-2026-61886HIGHWeintek cMT3092X Plaintext Storage of a PasswordEPSS 0.2%CVE-2025-53660MEDIUMJenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, incEPSS 0.2%CVE-2026-21660MEDIUMJohnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in FirmwareEPSS 0.2%CVE-2021-36317MEDIUMDell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially EPSS 0.2%CVE-2025-53669MEDIUMJenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential fEPSS 0.2%CVE-2025-12680MEDIUMBrocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)EPSS 0.2%CVE-2021-23207MEDIUMFresenius Kabi Agilia Connect Infusion System plaintext storage of a passwordEPSS 0.2%CVE-2024-39922MEDIUMA vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versionEPSS 0.2%CVE-2022-1794MEDIUMPlaintext Storage of a password in CODESYS V3 OPC DA ServerEPSS 0.2%CVE-2025-3758HIGHExposure of Device Configuration without Authentication in WF2220EPSS 0.2%