Weaknesses of type CWE-256

224 results

Senha codificada ou armazenamento em texto plano

É quando a senha ou credencial fica gravada direto no código-fonte, arquivo de configuração ou banco de dados sem criptografia. Qualquer um com acesso ao código, binário ou logs consegue ler a senha e comprometer sistemas. O risco aumenta exponencialmente se o código for versionado, distribuído ou ficar exposto em repositórios públicos.

Example

Um desenvolvedor escreve 'password = "admin123"' em uma variável de conexão ao banco, ou deixa credenciais de API em um arquivo .env commitado no Git. Um atacante clona o repositório ou decompila a aplicação e já tem acesso a sistemas críticos.

How to mitigate

Armazene senhas em gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault), use variáveis de ambiente seguras, nunca commite credenciais no versionamento, e implemente rotação automática de senhas. Em bancos de dados, sempre aplique hash com salt (bcrypt, Argon2) em vez de armazenar em texto plano.

CVE-2026-21417HIGHDell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged atEPSS 0.2%CVE-2026-31850MEDIUMPlaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+EPSS 0.2%CVE-2025-43005MEDIUMInformation Disclosure vulnerability in SAP GUI for WindowsEPSS 0.2%CVE-2021-3787MEDIUMA vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MEPSS 0.2%CVE-2022-47561HIGHUnprotected Storage of Credentials in Ormazabal productsEPSS 0.2%CVE-2024-45283MEDIUMInformation disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)EPSS 0.2%CVE-2022-41732MEDIUMIBM Maximo information disclosureEPSS 0.2%CVE-2024-27166HIGHInsecure permissionsEPSS 0.2%CVE-2022-4308MEDIUMClear-text passwords in configuration filesEPSS 0.2%CVE-2025-21102HIGHDell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with lEPSS 0.2%CVE-2025-24375MEDIUMMySQL K8s charm could leak credentials for root-level user `serverconfig`EPSS 0.2%CVE-2024-25052MEDIUMIBM Jazz Reporting Service information disclosureEPSS 0.2%CVE-2025-25727MEDIUMBosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.EPSS 0.2%CVE-2026-50641HIGHPlaintext password storage in Streamsoft Business IntelligenceEPSS 0.2%CVE-2024-21869MEDIUMPlaintext Storage of a Password in Rapid SCADAEPSS 0.2%CVE-2023-27315MEDIUMInformation Disclosure Vulnerability in SnapGathers EPSS 0.2%CVE-2025-2355MEDIUMBlackVue App API Endpoint credentials storageEPSS 0.2%CVE-2025-34210CRITICALVasion Print (formerly PrinterLogic) Readable Cleartext PasswordsEPSS 0.2%CVE-2025-36258HIGHIBM InfoSphere Information Server is vulnerable due to plaintext storage of a passwordEPSS 0.2%CVE-2024-22312MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.2%