Fallos del tipo CWE-256

224 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2025-53656MEDIUMJenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in jobEPSS 0.4%CVE-2024-28782MEDIUMIBM QRadar Suite Software information disclosureEPSS 0.4%CVE-2026-33216HIGHNATS has MQTT plaintext password disclosureEPSS 0.4%CVE-2025-7357HIGHPlaintext Storage of a Password in LITEON IC48A and IC80A EV ChargersEPSS 0.4%CVE-2026-15933MEDIUMCleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)EPSS 0.4%CVE-2025-13221MEDIUMIntelbras UnniTI usuarios.xml credentials storageEPSS 0.4%CVE-2023-4400MEDIUM A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and cEPSS 0.4%CVE-2025-61680MEDIUMMinecraft RCON Terminal: Plain Text Password Storage in ConfigurationEPSS 0.4%CVE-2023-50956MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.4%CVE-2026-42151HIGHPrometheus Azure AD remote write OAuth client secret exposed via config APIEPSS 0.4%CVE-2024-55026HIGHAn issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrarEPSS 0.3%CVE-2024-4232MEDIUMPassword Storage in Plaintext Vulnerability in Digisol RouterEPSS 0.3%CVE-2024-3625HIGHMirror-registry: redis password stored in plain-textEPSS 0.3%CVE-2024-3624HIGHMirror-registry: database user and password stored in plain-textEPSS 0.3%CVE-2022-43958HIGHA vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are EPSS 0.3%CVE-2025-53664MEDIUMJenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the JeEPSS 0.3%CVE-2021-47961HIGHA plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence EPSS 0.3%CVE-2023-3395MEDIUM ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files EPSS 0.3%CVE-2026-6597MEDIUMlangflow-ai langflow Flow Using API core.py has_api_terms credentials storageEPSS 0.3%CVE-2025-53655MEDIUMJenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potenEPSS 0.3%