Fallos del tipo CWE-255

62 resultados

Erros na Gestão de Credenciais

Fraqueza que ocorre quando credenciais (senhas, tokens, chaves de API) são armazenadas, transmitidas ou manipuladas de forma insegura no código ou na infraestrutura. Isso permite que atacantes roubem ou interceptem essas credenciais para acessar sistemas e dados sem autorização.

Ejemplo

Uma aplicação salva senhas de usuários em arquivo de configuração em texto plano, ou envia um token de autenticação via HTTP em vez de HTTPS. Alguém com acesso ao servidor ou à rede consegue ler essas credenciais e se passar pelo usuário legítimo.

Cómo mitigar

Use variáveis de ambiente ou gestores de secrets (como Vault, AWS Secrets Manager) para armazenar credenciais fora do código. Sempre transmita credenciais por canais criptografados (HTTPS/TLS), implemente rotação de chaves e aplique controle de acesso restritivo sobre quem pode acessar essas informações.

CVE-2025-15151MEDIUMTaleLin Lin-CMS Tests Folder config.py password in configuration fileEPSS 0.3%CVE-2020-1978MEDIUMVM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMsEPSS 0.3%CVE-2025-15128MEDIUMZKTeco BioTime Endpoint safe_setting credentials storageEPSS 0.3%CVE-2026-11552MEDIUMSourceCodester Onlne Examination & Learning Management System import_users.php hard-coded passwordEPSS 0.3%CVE-2020-24680HIGHImproper Credential Storage in Symphony PlusEPSS 0.3%CVE-2026-11515MEDIUMSourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded passwordEPSS 0.3%CVE-2020-8968HIGHParallels Remote Application Server credentials management errorsEPSS 0.3%CVE-2025-14183MEDIUMSGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storageEPSS 0.3%CVE-2021-21522HIGHDell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain aEPSS 0.2%CVE-2021-28498HIGHIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text coEPSS 0.2%CVE-2021-28499MEDIUMIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text cEPSS 0.2%CVE-2025-2555LOWAudi Universal Traffic Recorder App FTP Credentials hard-coded passwordEPSS 0.2%CVE-2025-11666HIGHTenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordEPSS 0.2%CVE-2025-2355MEDIUMBlackVue App API Endpoint credentials storageEPSS 0.2%CVE-2021-37000HIGHSome Huawei wearables have a permission management vulnerability.EPSS 0.1%CVE-2025-11649HIGHTomofun Furbo 360/Furbo Mini Root Account hard-coded passwordEPSS 0.1%CVE-2022-25327MEDIUMLocal Denial of Service in fscrypt PAM moduleEPSS 0.1%CVE-2026-4243LOWLa Nacion App app.lanacion.activity BuildConfig.java credentials storageEPSS 0.1%CVE-2026-4242LOWBabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storageEPSS 0.1%CVE-2026-4250LOWAlbert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storageEPSS 0.1%