Fallos del tipo CWE-313

30 resultados

Armazenamento de dados sensíveis em texto plano no disco

A aplicação salva informações sensíveis (senhas, tokens, chaves, dados pessoais) diretamente em arquivos ou no disco sem criptografia. Qualquer pessoa com acesso ao sistema de arquivos consegue ler esses dados, contornando completamente a segurança da aplicação.

Ejemplo

Um app de e-commerce que grava credenciais de banco de dados em um arquivo .conf, ou um cliente que escreve tokens de API em texto plano num arquivo de configuração local. Um atacante com acesso ao disco (mesmo sem privilégios de admin) lê tudo.

Cómo mitigar

Criptografe dados sensíveis antes de gravar no disco usando bibliotecas estabelecidas (ex: OpenSSL, libsodium); nunca armazene secrets diretamente em arquivos—use gestores de segredos (Vault, AWS Secrets Manager) ou variáveis de ambiente; se precisar de arquivo, defina permissões restrictivas (chmod 600) e considere criptografia transparente (LUKS, BitLocker).

CVE-2016-6538—TrackR Bravo mobile application stores account passwords in cleartextEPSS 1.1%CVE-2019-19291MEDIUMA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0)EPSS 0.7%CVE-2016-6547—Zizai Tech Nut stores the account password in cleartextEPSS 0.4%CVE-2016-6546—iTrack Easy mobile application stores the user password in base-64 encoding/cleartextEPSS 0.4%CVE-2018-10622MEDIUMMedtronic MyCareLink Patient Monitor Network Credential WeaknessEPSS 0.4%CVE-2025-2120LOWThinkware Car Dashcam F800 Pro Configuration File hostapd.conf cleartext storage in a file or on diskEPSS 0.3%CVE-2025-5098CRITICALKL-001-2025-003: Mobile Dynamix PrinterShare Mobile Print Gmail Oauth Token DisclosureEPSS 0.3%CVE-2024-5916MEDIUMPAN-OS: Cleartext Exposure of External System SecretsEPSS 0.2%CVE-2023-2863LOWSimple Design Daily Journal SQLite Database cleartext storage in a file or on diskEPSS 0.2%CVE-2023-35699MEDIUMCleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitiveEPSS 0.2%CVE-2026-5531MEDIUMSourceCodester Student Result Management System HTTP GET Request login_credentials.txt cleartext storage in fileEPSS 0.2%CVE-2025-14836MEDIUMZZCMS User Data Storage user_save.php cleartext storage in fileEPSS 0.2%CVE-2025-5154MEDIUMPhonePe App SQLite Database databases cleartext storage in a file or on diskEPSS 0.2%CVE-2024-9040MEDIUMcode-projects Blood Bank Management System Password cleartext storage in a file or on diskEPSS 0.2%CVE-2026-6598MEDIUMlangflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in fileEPSS 0.2%CVE-2023-4066MEDIUMOperator: passwords defined in secrets shown in statefulset yamlEPSS 0.2%CVE-2024-38280HIGHCleartext Storage in a File or on Disk in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)EPSS 0.2%CVE-2025-64305HIGHColumbia Weather Systems MicroServer Cleartext Storage in a File or on DiskEPSS 0.2%CVE-2026-6796MEDIUMSanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in fileEPSS 0.1%CVE-2024-49762MEDIUMPterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabledEPSS 0.1%