Weaknesses of type CWE-540

38 results

Exposição de informações sensíveis no código-fonte

Desenvolvedores deixam credenciais, tokens, chaves de API, URLs internas ou dados confidenciais hardcoded diretamente no código-fonte ou em arquivos de configuração versionados. Quando o repositório (ou backup) vaza, esses segredos ficam acessíveis a qualquer pessoa com acesso ao código.

Example

Um arquivo .py com `db_password = "admin123"` ou `.env` commitado no Git; uma variável de configuração em Java com `api_key = "sk-abc123xyz"` visível no histórico do repositório; ou uma string de conexão SQL em código comentado.

How to mitigate

Nunca commite segredos no versionamento — use variáveis de ambiente ou vaults (HashiCorp Vault, AWS Secrets Manager). Implemente pre-commit hooks para bloquear padrões suspeitos (regex para detectar chaves). Se já foi exposto, regenere as credenciais imediatamente e verifique logs de acesso.

CVE-2024-38327MEDIUMIBM Analytics Content Hub information disclosureEPSS 0.3%CVE-2024-9596LOWInclusion of Sensitive Information in Source Code in GitLabEPSS 0.3%CVE-2024-35144MEDIUMIBM Maximo Application Suite information disclosureEPSS 0.3%CVE-2024-27257MEDIUMIBM OpenPages information disclosureEPSS 0.3%CVE-2026-45728HIGHAlgernon: Single-file mode unconditionally enables debug modeEPSS 0.3%CVE-2025-36076MEDIUMIBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilitiesEPSS 0.3%CVE-2026-35383MEDIUMBentley Systems iTwin Platform exposed access tokenEPSS 0.3%CVE-2025-0923MEDIUMIBM Cognos Analytics information disclosureEPSS 0.3%CVE-2024-55907LOWIBM Cognos Mobile information disclosureEPSS 0.3%CVE-2026-101265LOWIntelbras TIP 125i Básico sensitive information in sourceEPSS 0.3%CVE-2021-28805HIGHInclusion of Sensitive Information in QSSEPSS 0.2%CVE-2025-36299MEDIUMIBM Planning Analytics Information DisclosureEPSS 0.2%CVE-2026-78192HIGHWebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index pageEPSS 0.2%CVE-2023-35013LOWIBM Security Verify Governance information disclosureEPSS 0.2%CVE-2026-103097HIGHGV-Eye Relay Payment API Key VulnerabilityEPSS 0.2%CVE-2026-103096HIGHGV-Eye Hardcoded API Key VulnerabilityEPSS 0.2%CVE-2026-22275MEDIUMDell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Inclusion of Sensitive Information iEPSS 0.1%CVE-2023-39250HIGH Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay ManagEPSS 0.1%