Fallos del tipo CWE-256

215 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2024-28736HIGHAn issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function.EPSS 2.5%CVE-2019-10921—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of passwords in the proEPSS 2.4%CVE-2017-16714—In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible withoutEPSS 2.4%CVE-2024-26165HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 1.9%CVE-2020-8183—A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.EPSS 1.9%CVE-2020-6961—In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XEPSS 1.6%CVE-2020-10609—Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system seEPSS 1.5%CVE-2018-7510—In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords areEPSS 1.4%CVE-2018-8851CRITICALEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versionsEPSS 1.3%CVE-2024-29978MEDIUMUser passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump fiEPSS 1.3%CVE-2017-6049—Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL.EPSS 1.3%CVE-2019-6518—Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.EPSS 1.2%CVE-2017-7913—A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3EPSS 1.2%CVE-2023-0457HIGHInformation Disclosure Vulnerability in MELSEC SeriesEPSS 1.2%CVE-2020-5374HIGHDell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptoEPSS 1.0%CVE-2021-32978HIGHAutomation Direct CLICK PLC CPU Modules Plaintext Storage of a PasswordEPSS 1.0%CVE-2021-1589MEDIUMCisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure VulnerabilityEPSS 1.0%CVE-2020-26079MEDIUMCisco IoT Field Network Director Unprotected Storage of Credentials VulnerabilityEPSS 1.0%CVE-2025-27656CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2EPSS 0.9%CVE-2024-43659HIGHPlaintext default credentials in firmwareEPSS 0.8%