Weaknesses of type CWE-522

689 results

Credenciais insuficientemente protegidas

Quando credenciais (senhas, tokens, chaves) são armazenadas, transmitidas ou processadas sem criptografia ou com proteção inadequada, ficam expostas a roubo. Um atacante que acessa o código-fonte, logs, memória ou intercepta a comunicação consegue recuperar as credenciais e usá-las para comprometer sistemas.

Example

Guardar senha em plain text no arquivo de configuração, enviar token em URL de GET em vez de POST/body criptografado, ou exibir credenciais completas em log de erro são exemplos clássicos. Se a chave de API está no repositório Git ou a senha no console, qualquer pessoa com acesso ao código a recupera.

How to mitigate

Nunca armazene credenciais em plain text — use variáveis de ambiente, secret managers (Vault, AWS Secrets Manager) ou bases de dados com criptografia. Na transmissão, force HTTPS/TLS. Em logs e mensagens de erro, mascare ou remova dados sensíveis. Implemente rotação de credenciais e use autenticação multi-fator quando possível.

CVE-2026-62213MEDIUMOpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound RequestsEPSS 0.4%CVE-2026-62208MEDIUMOpenClaw < 2026.6.5 Authorization Header Forwarding via SSEEPSS 0.4%CVE-2026-78555CRITICALRansomLook API Key Disclosure Through /admin/apikeys HTML SourceEPSS 0.4%CVE-2019-3782MEDIUMCredHub CLI writes environment variable credentials to diskEPSS 0.4%CVE-2026-42295HIGHArgo Workflows: Exposure of artifact repository credentialsEPSS 0.4%CVE-2026-35185HIGHHAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addressesEPSS 0.4%CVE-2024-47162MEDIUMIn JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageEPSS 0.4%CVE-2026-71862HIGHCheckmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is EnabledEPSS 0.4%CVE-2025-58366CRITICALOnyxia private helm repository credentials are leaked through unauthenticated APIEPSS 0.4%CVE-2026-92882LOWRedact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responsesEPSS 0.4%CVE-2026-24845MEDIUMmalcontent's OCI image scanning could expose registry credentialsEPSS 0.4%CVE-2026-75960HIGHInsufficiently Protected Credentials in Rently Smart HomeEPSS 0.4%CVE-2023-27126MEDIUMThe AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An atEPSS 0.4%CVE-2025-65098HIGHTypebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization BypassEPSS 0.3%CVE-2025-67732HIGHDify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration EndpointEPSS 0.3%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.3%CVE-2026-76859HIGHNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgiEPSS 0.3%CVE-2026-76857HIGHNetcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgiEPSS 0.3%CVE-2025-52095CRITICALAn issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dllEPSS 0.3%CVE-2026-53454MEDIUMBlueprint Studio stored Git credentials in plaintext Git credential storeEPSS 0.3%