Weaknesses of type CWE-522

689 results

Credenciais insuficientemente protegidas

Quando credenciais (senhas, tokens, chaves) são armazenadas, transmitidas ou processadas sem criptografia ou com proteção inadequada, ficam expostas a roubo. Um atacante que acessa o código-fonte, logs, memória ou intercepta a comunicação consegue recuperar as credenciais e usá-las para comprometer sistemas.

Example

Guardar senha em plain text no arquivo de configuração, enviar token em URL de GET em vez de POST/body criptografado, ou exibir credenciais completas em log de erro são exemplos clássicos. Se a chave de API está no repositório Git ou a senha no console, qualquer pessoa com acesso ao código a recupera.

How to mitigate

Nunca armazene credenciais em plain text — use variáveis de ambiente, secret managers (Vault, AWS Secrets Manager) ou bases de dados com criptografia. Na transmissão, force HTTPS/TLS. Em logs e mensagens de erro, mascare ou remova dados sensíveis. Implemente rotação de credenciais e use autenticação multi-fator quando possível.

CVE-2023-32268HIGHAdministrator equivalent Filr user can access proxy administrator credentialsEPSS 0.7%CVE-2022-0862LOWePO password change vulnerabilityEPSS 0.7%CVE-2020-8339MEDIUMA cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interfEPSS 0.7%CVE-2022-31044HIGHPlaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process AutomationEPSS 0.7%CVE-2025-34207HIGHVasion Print (formerly PrinterLogic) Insecure SSH Client ConfigurationEPSS 0.7%CVE-2025-14524MEDIUMbearer token leak on cross-protocol redirectEPSS 0.7%CVE-2025-34078HIGHNSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web InterfaceEPSS 0.7%CVE-2024-28110HIGHGo SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentialsEPSS 0.7%CVE-2023-40173HIGHUnsalted passwords in fobybus/social-media-skeletonEPSS 0.7%CVE-2024-7389HIGHForminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information ExposureEPSS 0.7%CVE-2026-56843CRITICALIncorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domaiEPSS 0.7%CVE-2020-5404MEDIUMAuthentication Leak On Redirect With Reactor Netty HttpClientEPSS 0.7%CVE-2025-3079MEDIUMA passback vulnerability which relates to office/small office multifunction printers and laser printers.EPSS 0.7%CVE-2025-3078MEDIUMA passback vulnerability which relates to production printers and office multifunction printers.EPSS 0.7%CVE-2023-26567HIGHSangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of gloEPSS 0.6%CVE-2023-6254HIGHPassword is send back to clientEPSS 0.6%CVE-2022-48433MEDIUMIn JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.EPSS 0.6%CVE-2023-37362HIGHWeintek Weincloud Improper AuthenticationEPSS 0.6%CVE-2026-62327CRITICAL9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/statsEPSS 0.6%CVE-2023-20965CRITICALIn processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. TEPSS 0.6%