Weaknesses of type CWE-259

224 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2024-4996CRITICALHardcoded Password in Wapro ERP DesktopEPSS 0.6%CVE-2024-34025CRITICALCyberPower PowerPanel business Use of Hard-coded PasswordEPSS 0.6%CVE-2024-42639CRITICALH3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.EPSS 0.6%CVE-2024-7159MEDIUMTOTOLINK A3600R Telnet Service product.ini hard-coded passwordEPSS 0.6%CVE-2023-2061MEDIUMAuthentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP ModulesEPSS 0.5%CVE-2024-34211HIGHTOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attacEPSS 0.5%CVE-2023-23770CRITICALMotorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing EPSS 0.5%CVE-2024-38902CRITICALH3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as rooEPSS 0.5%CVE-2024-25825CRITICALFydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the EPSS 0.5%CVE-2024-39345HIGHAdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support EPSS 0.5%CVE-2024-38885HIGHAn issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker tEPSS 0.5%CVE-2025-11284MEDIUMZytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded passwordEPSS 0.5%CVE-2026-70403CRITICALXING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected deEPSS 0.5%CVE-2024-33625CRITICALCyberPower PowerPanel business Use of Hard-coded PasswordEPSS 0.5%CVE-2024-34539CRITICALHardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. TEPSS 0.5%CVE-2023-37231CRITICALLoftware Spectrum before 4.6 HF14 uses a Hard-coded Password.EPSS 0.5%CVE-2025-70041CRITICALAn issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.EPSS 0.5%CVE-2021-27254MEDIUMThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is EPSS 0.5%CVE-2024-2420HIGHLenelS2 NetBox Hardcoded CredentialsEPSS 0.5%CVE-2025-59388MEDIUMHyper Data ProtectorEPSS 0.5%