Fallos del tipo CWE-256

233 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2024-36081CRITICALWestermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. EPSS 0.6%CVE-2024-23486CRITICALPlaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker wiEPSS 0.6%CVE-2024-36464LOWMedia Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exportedEPSS 0.6%CVE-2025-6561CRITICALHunt Electronic Hybrid DVR - Exposure of Sensitive System InformationEPSS 0.5%CVE-2026-15933MEDIUMCleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)EPSS 0.5%CVE-2024-52361MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.5%CVE-2025-4286MEDIUMIntelbras InControl Dispositivos Edição Page credentials storageEPSS 0.5%CVE-2023-35067HIGHPlaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval SystemEPSS 0.5%CVE-2025-48046MEDIUMMICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in CleartextEPSS 0.5%CVE-2024-3622HIGHMirror-registry: plain-text default csrf secret keyEPSS 0.5%CVE-2024-49370HIGHChange-Password via Portal-Profile sets PimcoreBackendUser password without hashingEPSS 0.5%CVE-2022-27548MEDIUMHCL Launch is vulnerable to information disclosure which can be read by a local user.EPSS 0.5%CVE-2023-35765MEDIUMPiiGAB M-Bus Plaintext Storage of a PasswordEPSS 0.5%CVE-2026-55765HIGHCloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database podEPSS 0.5%CVE-2025-5893CRITICALHonding Technology Smart Parking Management System - Exposure of Sensitive InformationEPSS 0.5%CVE-2023-42493HIGH EisBaer Scada - CWE-256: Plaintext Storage of a PasswordEPSS 0.5%CVE-2025-2770MEDIUMBEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-6118CRITICALHamastar MeetingHub Paperless Meetings - Plaintext Storage of a PasswordEPSS 0.5%CVE-2023-22389MEDIUM Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported viaEPSS 0.5%CVE-2025-15113CRITICALKsenia Security lares Home Automation 1.6 Remote Code Execution via MPFS UploadEPSS 0.5%