Weaknesses of type CWE-522

691 results

Credenciais insuficientemente protegidas

Quando credenciais (senhas, tokens, chaves) são armazenadas, transmitidas ou processadas sem criptografia ou com proteção inadequada, ficam expostas a roubo. Um atacante que acessa o código-fonte, logs, memória ou intercepta a comunicação consegue recuperar as credenciais e usá-las para comprometer sistemas.

Example

Guardar senha em plain text no arquivo de configuração, enviar token em URL de GET em vez de POST/body criptografado, ou exibir credenciais completas em log de erro são exemplos clássicos. Se a chave de API está no repositório Git ou a senha no console, qualquer pessoa com acesso ao código a recupera.

How to mitigate

Nunca armazene credenciais em plain text — use variáveis de ambiente, secret managers (Vault, AWS Secrets Manager) ou bases de dados com criptografia. Na transmissão, force HTTPS/TLS. Em logs e mensagens de erro, mascare ou remova dados sensíveis. Implemente rotação de credenciais e use autenticação multi-fator quando possível.

CVE-2025-62327MEDIUMHCL DevOps Deploy is susceptible to insufficiently protected credentialsEPSS 0.3%CVE-2026-16104MEDIUMKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminsEPSS 0.3%CVE-2026-72857HIGHBudibase before 3.40.0 Credential Exposure via STRING FieldsEPSS 0.3%CVE-2024-24595MEDIUMAllegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaEPSS 0.3%CVE-2026-49379MEDIUMIn JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesEPSS 0.3%CVE-2025-12636HIGHUbia UboxEPSS 0.3%CVE-2026-12984HIGHExposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601EPSS 0.3%CVE-2026-85720MEDIUMAsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT requestEPSS 0.3%CVE-2021-34700MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-16553MEDIUMInsufficiently Protected Credentials in GitLabEPSS 0.3%CVE-2026-49949MEDIUMCodexBar < 0.33.0 Credential Leakage via HTTP RedirectEPSS 0.3%CVE-2026-29872HIGHA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab82EPSS 0.3%CVE-2021-33107MEDIUMInsufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and InEPSS 0.3%CVE-2026-46440HIGHFlowise: Basic Auth Credentials Exposed via APIEPSS 0.3%CVE-2026-48976HIGHHomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook HijackEPSS 0.3%CVE-2026-72794CRITICALsiyuan before v3.7.4 Session Cookie Key Disclosure via getConfEPSS 0.2%CVE-2025-54467MEDIUMNeuVector process with sensitive arguments lead to leakageEPSS 0.2%CVE-2020-7306MEDIUMDLP for Mac - Unprotected Storage of CredentialsEPSS 0.2%CVE-2021-3681—A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explEPSS 0.2%CVE-2026-7017HIGHHTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targetsEPSS 0.2%