Fallos del tipo CWE-256

233 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2025-5760MEDIUMSimple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective ModeEPSS 0.5%CVE-2026-82453HIGHrust-iot-platform Cleartext Password Storage via User ModelEPSS 0.5%CVE-2026-46488CRITICALmotionEye: Authentication possible via password hashEPSS 0.5%CVE-2025-56527HIGHPlaintext password storage in Kotaemon 0.11.0 in the client's localStorage.EPSS 0.5%CVE-2023-5775LOWBackWPup <= 4.0.2 - Plaintext Storage of Backup Destination PasswordEPSS 0.4%CVE-2023-6518HIGHPassword Disclosure in Mia Technology's Mia-MedEPSS 0.4%CVE-2019-0032MEDIUMJunos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files.EPSS 0.4%CVE-2024-39220MEDIUMBAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-EPSS 0.4%CVE-2020-25184HIGHRockwell Automation ISaGRAF5 Runtime Unprotected Storage of CredentialsEPSS 0.4%CVE-2023-26204LOWA plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versionEPSS 0.4%CVE-2026-46513HIGHFrogman: API tokens stored in plaintextEPSS 0.4%CVE-2024-5960CRITICALPlaintext Storage of a Password in Eliz Software's PanelEPSS 0.4%CVE-2024-3623MEDIUMMirror-registry: default database secret key stored in plain-text on initial configuration fileEPSS 0.4%CVE-2024-41336HIGHDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior EPSS 0.4%CVE-2025-1709MEDIUMCVE-2025-1709EPSS 0.4%CVE-2025-7357HIGHPlaintext Storage of a Password in LITEON IC48A and IC80A EV ChargersEPSS 0.4%CVE-2024-40116HIGHAn issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html,EPSS 0.4%CVE-2025-53656MEDIUMJenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in jobEPSS 0.4%CVE-2023-48700MEDIUMClear Text Credentials Exposed via Onboarding TaskEPSS 0.4%CVE-2023-2633MEDIUMAPI keys stored and displayed in plain text by Code Dx Plugin EPSS 0.4%