Weaknesses of type CWE-522

691 results

Credenciais insuficientemente protegidas

Quando credenciais (senhas, tokens, chaves) são armazenadas, transmitidas ou processadas sem criptografia ou com proteção inadequada, ficam expostas a roubo. Um atacante que acessa o código-fonte, logs, memória ou intercepta a comunicação consegue recuperar as credenciais e usá-las para comprometer sistemas.

Example

Guardar senha em plain text no arquivo de configuração, enviar token em URL de GET em vez de POST/body criptografado, ou exibir credenciais completas em log de erro são exemplos clássicos. Se a chave de API está no repositório Git ou a senha no console, qualquer pessoa com acesso ao código a recupera.

How to mitigate

Nunca armazene credenciais em plain text — use variáveis de ambiente, secret managers (Vault, AWS Secrets Manager) ou bases de dados com criptografia. Na transmissão, force HTTPS/TLS. Em logs e mensagens de erro, mascare ou remova dados sensíveis. Implemente rotação de credenciais e use autenticação multi-fator quando possível.

CVE-2026-28714MEDIUMUnnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows)EPSS 0.2%CVE-2025-46820HIGHphpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifactEPSS 0.2%CVE-2023-26221MEDIUMTIBCO Spotfire Insufficiently Protected Credential vulnerabilityEPSS 0.2%CVE-2025-58742HIGHInsufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector CaptureEPSS 0.2%CVE-2025-6227LOWInvite token is used as part of the secure communicationEPSS 0.2%CVE-2021-27785LOWHCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)EPSS 0.2%CVE-2025-2908HIGHInsufficiently Protected Credentials vulnerability in MeetMe productsEPSS 0.2%CVE-2024-29216MEDIUMExposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user wEPSS 0.2%CVE-2025-0760LOWStored Credential Disclosure VulnerabilityEPSS 0.2%CVE-2026-48022MEDIUM@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirectsEPSS 0.2%CVE-2026-1966LOWYugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UIEPSS 0.2%CVE-2023-28088HIGHAn HPE OneView appliance dump may expose SAN switch administrative credentialsEPSS 0.2%CVE-2023-43634HIGH Config Partition Not Protected by Measured BootEPSS 0.2%CVE-2026-32606HIGHIncusOS has a LUKS encryption bypass due to insufficient TPM policyEPSS 0.2%CVE-2024-23551MEDIUMHCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpointEPSS 0.2%CVE-2023-28090MEDIUMAn HPE OneView appliance dump may expose SNMPv3 read credentialsEPSS 0.2%CVE-2025-2311CRITICALAuthentication Bypass in Sechard Information Technologies' SecHardEPSS 0.2%CVE-2023-43631HIGHSSH as Root Unlockable Without Triggering Measured BootEPSS 0.2%CVE-2023-28087MEDIUMAn HPE OneView appliance dump may expose OneView user accountsEPSS 0.2%CVE-2023-28089HIGHAn HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect ModulesEPSS 0.2%