Fallos del tipo CWE-259

210 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2014-5431—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded passEPSS 0.4%CVE-2025-7080MEDIUMDone-0 Jank JWT Token jwt_utils.go hard-coded passwordEPSS 0.4%CVE-2026-25753CRITICALPlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)EPSS 0.4%CVE-2024-31798MEDIUMIdentical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrEPSS 0.4%CVE-2018-8870MEDIUMMedtronic MyCareLink Patient Monitor Use of Hard-coded PasswordEPSS 0.4%CVE-2025-9725LOWCudy LT500E Web shadow hard-coded passwordEPSS 0.4%CVE-2024-3700CRITICALHardcoded password in Estomed Sp. z o.o. Simple Care softwareEPSS 0.4%CVE-2026-71809HIGHAuthentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticateEPSS 0.4%CVE-2020-7590—A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers EPSS 0.4%CVE-2025-25428HIGHTRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in aEPSS 0.4%CVE-2025-2343HIGHIROAD Dash Cam X5/Dash Cam X6 Device Pairing hard-coded credentialsEPSS 0.4%CVE-2020-12012—Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,EPSS 0.3%CVE-2025-47748MEDIUMNetwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.EPSS 0.3%CVE-2025-7577MEDIUMTeledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded passwordEPSS 0.3%CVE-2020-12039—Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 357EPSS 0.3%CVE-2025-13252MEDIUMshsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentialsEPSS 0.3%CVE-2026-6578MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2024-21990MEDIUMDefault Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utilityEPSS 0.3%CVE-2023-28895LOWHard-coded password for access to power controller chip memoryEPSS 0.3%CVE-2023-49963HIGHDYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control.EPSS 0.3%