Weaknesses of type CWE-798

941 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2024-23619CRITICALIBM Merge Healthcare eFilm Workstation Hardcoded CredentialsEPSS 1.7%CVE-2024-8162CRITICALTOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentialsEPSS 1.7%CVE-2020-10270CRITICALRVD#2557: Hardcoded Credentials on MiRX00 Control DashboardEPSS 1.7%CVE-2019-19108CRITICALB&R Automation Runtime SNMP Authentication and Authorization WeaknessEPSS 1.6%CVE-2024-9594MEDIUMVM images built with Image Builder with some providers use default credentials during buildsEPSS 1.6%CVE-2018-5560CRITICALGuardzilla All-In-One Video Security System Hard-Coded CredentialEPSS 1.6%CVE-2018-5551CRITICALDocuTrac DTISQLInstaller.exe Hard-Coded CredentialsEPSS 1.6%CVE-2019-0020CRITICALJuniper ATP: Hard coded credentials used in Web CollectorEPSS 1.6%CVE-2020-3165HIGHCisco NX-OS Software Border Gateway Protocol MD5 Authentication Bypass VulnerabilityEPSS 1.6%CVE-2022-30997MEDIUMUse of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker EPSS 1.6%CVE-2012-6428—Carlo Gavazzi EOS Box Hard-Coded CredentialsEPSS 1.5%CVE-2020-5248HIGHPublic GLPIKEY can be used to decrypt any data in GLPIEPSS 1.5%CVE-2022-46637CRITICALProlink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.EPSS 1.5%CVE-2020-10276CRITICALRVD#2558: Default credentials on SICK PLC allows disabling safety featuresEPSS 1.5%CVE-2018-15720—Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the localEPSS 1.5%CVE-2022-34151CRITICALUse of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automatEPSS 1.5%CVE-2023-36013MEDIUMPowerShell Information Disclosure VulnerabilityEPSS 1.4%CVE-2022-32965CRITICALITPison OMICARD EDM - Use of Hard-coded CredentialsEPSS 1.4%CVE-2021-32535CRITICALQSAN SANOS - Use of Hard-coded CredentialsEPSS 1.4%CVE-2020-3446CRITICALCisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials VulnerabilityEPSS 1.4%