Fallos del tipo CWE-256

224 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2024-36464LOWMedia Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exportedEPSS 0.6%CVE-2022-43426MEDIUMJenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to oEPSS 0.5%CVE-2023-35067HIGHPlaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval SystemEPSS 0.5%CVE-2024-52361MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.5%CVE-2025-48046MEDIUMMICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in CleartextEPSS 0.5%CVE-2025-13187MEDIUMIntelbras ICIP acessodeusuario.xml credentials storageEPSS 0.5%CVE-2025-6561CRITICALHunt Electronic Hybrid DVR - Exposure of Sensitive System InformationEPSS 0.5%CVE-2024-3622HIGHMirror-registry: plain-text default csrf secret keyEPSS 0.5%CVE-2024-49370HIGHChange-Password via Portal-Profile sets PimcoreBackendUser password without hashingEPSS 0.5%CVE-2023-35765MEDIUMPiiGAB M-Bus Plaintext Storage of a PasswordEPSS 0.5%CVE-2025-4286MEDIUMIntelbras InControl Dispositivos Edição Page credentials storageEPSS 0.5%CVE-2022-27548MEDIUMHCL Launch is vulnerable to information disclosure which can be read by a local user.EPSS 0.5%CVE-2025-2770MEDIUMBEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-6118CRITICALHamastar MeetingHub Paperless Meetings - Plaintext Storage of a PasswordEPSS 0.5%CVE-2025-5893CRITICALHonding Technology Smart Parking Management System - Exposure of Sensitive InformationEPSS 0.5%CVE-2025-15113CRITICALKsenia Security lares Home Automation 1.6 Remote Code Execution via MPFS UploadEPSS 0.5%CVE-2023-22389MEDIUM Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported viaEPSS 0.5%CVE-2023-6518HIGHPassword Disclosure in Mia Technology's Mia-MedEPSS 0.5%CVE-2023-5775LOWBackWPup <= 4.0.2 - Plaintext Storage of Backup Destination PasswordEPSS 0.4%CVE-2025-5760MEDIUMSimple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective ModeEPSS 0.4%