Weaknesses of type CWE-798

941 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2017-13108—DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13101—Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13100—DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13106—Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2021-33016CRITICALKUKA KR C4 - Use of Hard-Coded CredentialsEPSS 1.0%CVE-2017-13104—Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13102—Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2026-2635HIGHMLflow Use of Default Password Authentication Bypass VulnerabilityEPSS 1.0%CVE-2022-26671HIGHTAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded CredentialsEPSS 1.0%CVE-2018-0039MEDIUMContrail Service Orchestration: Hardcoded credentials for Grafana serviceEPSS 1.0%CVE-2023-33236CRITICALMXsecurity Hardcoded Credential VulnerabilityEPSS 1.0%CVE-2022-21194—The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUMEPSS 1.0%CVE-2020-3318HIGHCisco Firepower Management Center Static Credential VulnerabilitiesEPSS 1.0%CVE-2023-25187MEDIUMAn issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factEPSS 1.0%CVE-2017-13107—Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2023-35724HIGHD-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.9%CVE-2023-37287CRITICALSmartBPM.NET - Use of Hard-Coded Credentials - 2EPSS 0.9%CVE-2022-22522CRITICALHard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the deviceEPSS 0.9%CVE-2020-5222MEDIUMHard-Coded Key Used For Remember-me Token in OpenCastEPSS 0.9%CVE-2022-48113CRITICALA vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POSTEPSS 0.9%