Weaknesses of type CWE-260

24 results

Senha armazenada em arquivo de configuração

A aplicação guarda credenciais em texto plano ou minimamente ofuscadas em arquivos de configuração (.env, .properties, .xml, .conf, etc.), acessíveis ao sistema de arquivos. Qualquer pessoa com acesso local ou remoto ao arquivo consegue ler as credenciais sem esforço.

Example

Um arquivo config.properties contém 'db.password=senha123' ou um .env com 'API_KEY=sk-1234abcd'. Se o arquivo vazar para repositório Git, for exposto por misconfiguration de permissões ou capturado em backup desencriptado, o atacante herda acesso direto ao banco de dados ou API.

How to mitigate

Use gerenciadores de secrets (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou variáveis de ambiente isoladas do versionamento; nunca commite credenciais em Git; aplique permissões restritivas (modo 600) e rotação periódica de senhas/tokens.

CVE-2017-7925—A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IEPSS 51.4%CVE-2017-7923—A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xEPSS 2.3%CVE-2016-7043MEDIUMIt has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properEPSS 1.5%CVE-2019-3780CRITICALCloud Foundry Container Runtime Leaks IAAS CredentialsEPSS 1.4%CVE-2023-34128—Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlieEPSS 0.7%CVE-2023-53739CRITICALTinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup DisclosureEPSS 0.6%CVE-2023-53770HIGHMiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup EndpointEPSS 0.5%CVE-2019-25465HIGHHisilicon HiIpcam V100R003 Information Disclosure via Directory TraversalEPSS 0.5%CVE-2021-35033HIGHA vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managemEPSS 0.4%CVE-2020-5721—MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field EPSS 0.4%CVE-2025-32111HIGHThe Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for EPSS 0.4%CVE-2025-57754CRITICALeslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)EPSS 0.4%CVE-2025-33093HIGHIBM Sterling Partner Engagement Manager information disclosureEPSS 0.4%CVE-2014-5400—Hospira MedNet Password in Configuration FileEPSS 0.3%CVE-2025-25022CRITICALIBM QRadar Suite Software and IBM Cloud Pak for Security information disclosureEPSS 0.3%CVE-2025-15151MEDIUMTaleLin Lin-CMS Tests Folder config.py password in configuration fileEPSS 0.3%CVE-2023-2790LOWTOTOLINK N200RE Telnet Service custom.conf password in configuration fileEPSS 0.3%CVE-2025-51540MEDIUMEzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and aEPSS 0.2%CVE-2025-33119MEDIUMIBM QRadar SIEM Information DisclosureEPSS 0.2%CVE-2024-49817MEDIUMIBM Security Guardium Key Lifecycle Manager information disclosureEPSS 0.2%