Weaknesses of type CWE-259

210 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2020-12045—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), opEPSS 1.7%CVE-2014-5434—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account withEPSS 1.6%CVE-2020-2499MEDIUMHard-coded Password Vulnerability in QESEPSS 1.4%CVE-2019-13530—Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501,EPSS 1.4%CVE-2021-27440—The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components EPSS 1.4%CVE-2024-8580CRITICALTOTOLINK AC1200 T8 shadow.sample hard-coded passwordEPSS 1.3%CVE-2022-29831HIGHUse of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unautheEPSS 1.3%CVE-2024-26196MEDIUMMicrosoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityEPSS 1.2%CVE-2017-20039CRITICALSICUNET Access Controller hard-coded passwordEPSS 1.2%CVE-2025-6932MEDIUMD-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded passwordEPSS 1.2%CVE-2021-38456CRITICALMoxa MXview Network Management SoftwareEPSS 1.2%CVE-2017-6039—A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded EPSS 1.2%CVE-2026-2616HIGHBeetel 777VR1 Web Management hard-coded credentialsEPSS 1.2%CVE-2025-20286CRITICALISE on AWS Static CredentialEPSS 1.1%CVE-2021-28813CRITICALInsufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitchEPSS 1.1%CVE-2021-34601CRITICALBender Charge Controller: Hardcoded Credentials in Charge ControllerEPSS 1.1%CVE-2021-36312CRITICALDell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowlEPSS 1.1%CVE-2020-5351HIGHDell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with aEPSS 1.1%CVE-2022-30271CRITICALThe Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_servEPSS 1.0%CVE-2022-27172MEDIUMA hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafteEPSS 1.0%