Weaknesses of type CWE-798

941 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2022-29778HIGHD-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' atEPSS 2.7%CVE-2021-31477MEDIUMThis vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is EPSS 2.6%CVE-2026-56265CRITICALCrawl4AI - Authentication Bypass via Hardcoded JWT Signing KeyEPSS 2.6%CVE-2019-1675HIGHCisco Aironet Active Sensor Static Credentials VulnerabilityEPSS 2.6%CVE-2020-3158CRITICALCisco Smart Software Manager On-Prem Static Default Credential VulnerabilityEPSS 2.6%CVE-2017-14027—A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FXEPSS 2.5%CVE-2019-13657CRITICALCA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote EPSS 2.5%CVE-2024-5471HIGHAgent takeoverEPSS 2.5%CVE-2014-125115CRITICALPandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCEEPSS 2.5%CVE-2021-40390CRITICALAn authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP reqEPSS 2.5%CVE-2023-20101CRITICALA vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root EPSS 2.4%CVE-2022-22722—A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain theEPSS 2.4%CVE-2018-0329—A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application ServiceEPSS 2.4%CVE-2023-44411CRITICALD-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass VulnerabilityEPSS 2.4%CVE-2019-13553—Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected syEPSS 2.3%CVE-2020-3382CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilityEPSS 2.3%CVE-2020-6981—In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.EPSS 2.3%CVE-2022-22056CRITICALLe-yan Co., Ltd. dental management system - Hard-coded CredentialsEPSS 2.3%CVE-2026-19900CRITICALLB-LINK X-PRO shadow hard-coded credentialsEPSS 2.2%CVE-2024-9486CRITICALVM images built with Image Builder and Proxmox provider use default credentialsEPSS 2.2%