Fallos del tipo CWE-259

211 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2020-12045—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), opEPSS 1.7%CVE-2014-5434—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account withEPSS 1.6%CVE-2020-2499MEDIUMHard-coded Password Vulnerability in QESEPSS 1.4%CVE-2019-13530—Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501,EPSS 1.4%CVE-2021-27440—The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components EPSS 1.4%CVE-2024-8580CRITICALTOTOLINK AC1200 T8 shadow.sample hard-coded passwordEPSS 1.3%CVE-2022-29831HIGHUse of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unautheEPSS 1.3%CVE-2024-26196MEDIUMMicrosoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityEPSS 1.2%CVE-2017-20039CRITICALSICUNET Access Controller hard-coded passwordEPSS 1.2%CVE-2025-6932MEDIUMD-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded passwordEPSS 1.2%CVE-2021-38456CRITICALMoxa MXview Network Management SoftwareEPSS 1.2%CVE-2017-6039—A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded EPSS 1.2%CVE-2026-2616HIGHBeetel 777VR1 Web Management hard-coded credentialsEPSS 1.2%CVE-2025-20286CRITICALISE on AWS Static CredentialEPSS 1.1%CVE-2021-28813CRITICALInsufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitchEPSS 1.1%CVE-2021-34601CRITICALBender Charge Controller: Hardcoded Credentials in Charge ControllerEPSS 1.1%CVE-2021-36312CRITICALDell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowlEPSS 1.1%CVE-2020-5351HIGHDell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with aEPSS 1.1%CVE-2022-30271CRITICALThe Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_servEPSS 1.0%CVE-2022-27172MEDIUMA hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafteEPSS 1.0%