Weaknesses of type CWE-256

224 results

Senha codificada ou armazenamento em texto plano

É quando a senha ou credencial fica gravada direto no código-fonte, arquivo de configuração ou banco de dados sem criptografia. Qualquer um com acesso ao código, binário ou logs consegue ler a senha e comprometer sistemas. O risco aumenta exponencialmente se o código for versionado, distribuído ou ficar exposto em repositórios públicos.

Example

Um desenvolvedor escreve 'password = "admin123"' em uma variável de conexão ao banco, ou deixa credenciais de API em um arquivo .env commitado no Git. Um atacante clona o repositório ou decompila a aplicação e já tem acesso a sistemas críticos.

How to mitigate

Armazene senhas em gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault), use variáveis de ambiente seguras, nunca commite credenciais no versionamento, e implemente rotação automática de senhas. Em bancos de dados, sempre aplique hash com salt (bcrypt, Argon2) em vez de armazenar em texto plano.

CVE-2019-0072MEDIUMSBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.EPSS 0.2%CVE-2021-43590MEDIUMDell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability.EPSS 0.2%CVE-2025-36002MEDIUMIBM Sterling B2B Integrator information disclosureEPSS 0.1%CVE-2024-28961MEDIUMDell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged maliEPSS 0.1%CVE-2018-25130MEDIUMBeward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted DatabaseEPSS 0.1%CVE-2024-49351MEDIUMIBM Workload Scheduler information disclosureEPSS 0.1%CVE-2024-28325MEDIUMAsus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router seEPSS 0.1%CVE-2020-3483HIGHDuo Network Gateway (DNG) Information Disclosure VulnerabilityEPSS 0.1%CVE-2024-39733MEDIUMIBM Datacap Navigator information disclosureEPSS 0.1%CVE-2024-20489HIGHCisco Routed Passive Optical Network Cleartext Password VulnerabilityEPSS 0.1%CVE-2024-10334HIGHCamera passwords stored in clear textEPSS 0.1%CVE-2026-36174MEDIUMGNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial consoleEPSS 0.1%CVE-2023-50945MEDIUMIBM Common Licensing information disclosureEPSS 0.1%CVE-2024-22432HIGH Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL DEPSS 0.1%CVE-2024-53292HIGHDell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privilegedEPSS 0.1%CVE-2024-45638MEDIUMIBM QRadar EDR information disclosureEPSS 0.1%CVE-2026-41874MEDIUMHard-coded admin credentials in Quick.CartEPSS 0.1%CVE-2024-37135LOWDM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnEPSS 0.1%CVE-2026-14867MEDIUMInsecure password storage in User directoryEPSS 0.1%CVE-2024-43378HIGHcalamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systemsEPSS 0.1%