Weaknesses of type CWE-522

689 results

Credenciais insuficientemente protegidas

Quando credenciais (senhas, tokens, chaves) são armazenadas, transmitidas ou processadas sem criptografia ou com proteção inadequada, ficam expostas a roubo. Um atacante que acessa o código-fonte, logs, memória ou intercepta a comunicação consegue recuperar as credenciais e usá-las para comprometer sistemas.

Example

Guardar senha em plain text no arquivo de configuração, enviar token em URL de GET em vez de POST/body criptografado, ou exibir credenciais completas em log de erro são exemplos clássicos. Se a chave de API está no repositório Git ou a senha no console, qualquer pessoa com acesso ao código a recupera.

How to mitigate

Nunca armazene credenciais em plain text — use variáveis de ambiente, secret managers (Vault, AWS Secrets Manager) ou bases de dados com criptografia. Na transmissão, force HTTPS/TLS. Em logs e mensagens de erro, mascare ou remova dados sensíveis. Implemente rotação de credenciais e use autenticação multi-fator quando possível.

CVE-2026-76854HIGHNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgiEPSS 0.5%CVE-2025-54428CRITICALRevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)EPSS 0.5%CVE-2022-46155HIGHAirtable.js credentials exposed in browser buildsEPSS 0.5%CVE-2025-27231MEDIUMLDAP 'Bind password' field value can be leaked by a Zabbix Super AdminEPSS 0.5%CVE-2025-34139HIGHSitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File ReadEPSS 0.5%CVE-2023-23463MEDIUM Sunell DVR – Insufficiently Protected CredentialsEPSS 0.5%CVE-2025-54876MEDIUMJans CLI stores plaintext passwords in the local cli_cmd.log fileEPSS 0.5%CVE-2026-56783HIGHParseable < 2.9.2 - Cleartext Credential Exposure in Notification Target APIEPSS 0.5%CVE-2023-48010CRITICALSTMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as Supervisor on the SEPSS 0.5%CVE-2022-27560MEDIUMAn insufficiently protected credential vulnerability affects HCL VersionVault ExpressEPSS 0.5%CVE-2026-3783MEDIUMtoken leak with redirect and netrcEPSS 0.5%CVE-2026-27167NONEGradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session SecretEPSS 0.5%CVE-2025-2772MEDIUMBEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure VulnerabilityEPSS 0.5%CVE-2020-36968HIGHM/Monit 3.7.4 - Password DisclosureEPSS 0.4%CVE-2026-8926CRITICALpassword leak with netrc and user in URLEPSS 0.4%CVE-2026-11827MEDIUMInsufficiently Protected Credentials in GitLabEPSS 0.4%CVE-2023-43905HIGHIncorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.EPSS 0.4%CVE-2024-38505MEDIUMIn JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteEPSS 0.4%CVE-2022-27544MEDIUMHCL BigFix Web Reports authorized users may see sensitive information in clear textEPSS 0.4%CVE-2026-44938HIGHFleet has PSS Bypass through addLabelsFromOptions in Fleet AgentEPSS 0.4%