Fallos del tipo CWE-256

224 resultados

Senha codificada ou armazenada em texto plano

Ocorre quando uma senha é embutida diretamente no código-fonte ou armazenada sem criptografia em arquivos de configuração, banco de dados ou logs. Qualquer pessoa com acesso ao binário, código ou infraestrutura consegue ler a credencial e comprometer a aplicação ou sistemas integrados.

Ejemplo

Um desenvolvedor escreve `conexao = mysql_connect('localhost', 'root', 'senha123')` diretamente no PHP, ou salva credenciais de API em um arquivo .env versionado no Git. Quando o repositório vaza ou alguém faz engenharia reversa do binário, as senhas são capturadas.

Cómo mitigar

Use gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault), armazene hashes criptografados com sal em banco de dados, injete credenciais via variáveis de ambiente em runtime, e nunca commite chaves no repositório — mantenha-as separadas da base de código.

CVE-2026-21417HIGHDell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged atEPSS 0.2%CVE-2026-31850MEDIUMPlaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+EPSS 0.2%CVE-2025-43005MEDIUMInformation Disclosure vulnerability in SAP GUI for WindowsEPSS 0.2%CVE-2021-3787MEDIUMA vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MEPSS 0.2%CVE-2022-47561HIGHUnprotected Storage of Credentials in Ormazabal productsEPSS 0.2%CVE-2024-45283MEDIUMInformation disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)EPSS 0.2%CVE-2022-41732MEDIUMIBM Maximo information disclosureEPSS 0.2%CVE-2024-27166HIGHInsecure permissionsEPSS 0.2%CVE-2022-4308MEDIUMClear-text passwords in configuration filesEPSS 0.2%CVE-2025-21102HIGHDell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with lEPSS 0.2%CVE-2025-24375MEDIUMMySQL K8s charm could leak credentials for root-level user `serverconfig`EPSS 0.2%CVE-2024-25052MEDIUMIBM Jazz Reporting Service information disclosureEPSS 0.2%CVE-2025-25727MEDIUMBosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.EPSS 0.2%CVE-2026-50641HIGHPlaintext password storage in Streamsoft Business IntelligenceEPSS 0.2%CVE-2024-21869MEDIUMPlaintext Storage of a Password in Rapid SCADAEPSS 0.2%CVE-2023-27315MEDIUMInformation Disclosure Vulnerability in SnapGathers EPSS 0.2%CVE-2025-2355MEDIUMBlackVue App API Endpoint credentials storageEPSS 0.2%CVE-2025-34210CRITICALVasion Print (formerly PrinterLogic) Readable Cleartext PasswordsEPSS 0.2%CVE-2025-36258HIGHIBM InfoSphere Information Server is vulnerable due to plaintext storage of a passwordEPSS 0.2%CVE-2024-22312MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.2%