Weaknesses of type CWE-522

691 results

Credenciais insuficientemente protegidas

Quando credenciais (senhas, tokens, chaves) são armazenadas, transmitidas ou processadas sem criptografia ou com proteção inadequada, ficam expostas a roubo. Um atacante que acessa o código-fonte, logs, memória ou intercepta a comunicação consegue recuperar as credenciais e usá-las para comprometer sistemas.

Example

Guardar senha em plain text no arquivo de configuração, enviar token em URL de GET em vez de POST/body criptografado, ou exibir credenciais completas em log de erro são exemplos clássicos. Se a chave de API está no repositório Git ou a senha no console, qualquer pessoa com acesso ao código a recupera.

How to mitigate

Nunca armazene credenciais em plain text — use variáveis de ambiente, secret managers (Vault, AWS Secrets Manager) ou bases de dados com criptografia. Na transmissão, force HTTPS/TLS. Em logs e mensagens de erro, mascare ou remova dados sensíveis. Implemente rotação de credenciais e use autenticação multi-fator quando possível.

CVE-2019-11820MEDIUMInformation exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentiaEPSS 0.3%CVE-2021-47741HIGHZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration EndpointEPSS 0.3%CVE-2021-32039MEDIUMMongoDB Extension for VS Code may unexpectedly store credentials locally in clear textEPSS 0.3%CVE-2024-39878MEDIUMIn JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App ConnectionEPSS 0.3%CVE-2026-92256HIGHNetcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read HandlersEPSS 0.3%CVE-2026-25774MEDIUMEV Energy ev.energy Insufficiently Protected CredentialsEPSS 0.3%CVE-2026-76871HIGHNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read HandlersEPSS 0.3%CVE-2024-47109MEDIUMIBM Sterling File Gateway information disclosureEPSS 0.3%CVE-2024-11856LOWHPE IceWall Products, Remote Unauthorized Data ModificationEPSS 0.3%CVE-2026-55854MEDIUMMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbEPSS 0.3%CVE-2026-22878MEDIUMMobility46 mobility46.se Insufficiently Protected CredentialsEPSS 0.3%CVE-2026-29128HIGHIDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable FilesEPSS 0.3%CVE-2025-61776MEDIUMDependency-Track possibly discloses private NuGet repository credentials to api.nuget.orgEPSS 0.3%CVE-2026-53586MEDIUMlibgit2: HTTP transport can leak credentials to an offsite redirect targetEPSS 0.3%CVE-2026-91982MEDIUMVikunja before 2.6.0 TOTP Secret Disclosure via APIEPSS 0.3%CVE-2026-23922LOWEmail media OAuth secret leak to Super AdminEPSS 0.3%CVE-2025-42933HIGHInsecure Storage of Sensitive Information in SAP Business One (SLD)EPSS 0.3%CVE-2026-46511HIGHHAXcms: Mass Token Exfiltration and Cross-Tenant HijackEPSS 0.3%CVE-2025-53667MEDIUMJenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potentiaEPSS 0.3%CVE-2026-20733MEDIUMCloudCharge cloudcharge.se Insufficiently Protected CredentialsEPSS 0.3%