Fallos del tipo CWE-316

36 resultados

Armazenamento de dados sensíveis em claro na memória

A aplicação mantém informações sensíveis (senhas, tokens, chaves criptográficas) em texto plano na memória RAM durante a execução. Um atacante que ganhe acesso ao processo (via dump de memória, debugger, ou vulnerabilidade de leitura) consegue extrair esses dados diretamente sem precisar quebrar criptografia.

Ejemplo

Um app lê a senha do usuário em uma string e a mantém intacta na memória enquanto executa operações. Se o código cair em um debugger, ou se um dump de memória for capturado, a senha fica visível em claro. Outro caso: armazenar tokens JWT decodificados em variáveis globais sem limpeza após uso.

Cómo mitigar

Zerize (sobrescreva) dados sensíveis logo após o uso com funções específicas (ex: `sodium_memzero()` em PHP, `SecureString` em .NET, ou estruturas `volatile` em C/C++). Considere usar gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager) e evite armazenar credenciais em memória por mais tempo que o necessário.

CVE-2014-2366—Advantech WebAccess Cleartext Storage of Sensitive Information in MemoryEPSS 1.3%CVE-2024-33901MEDIUMIssue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in the .kdbx database viEPSS 0.7%CVE-2022-29832LOWCleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GEPSS 0.6%CVE-2019-3733MEDIUMRSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of Heap Memory Before EPSS 0.6%CVE-2023-3762MEDIUMIntergard SGS sensitive information in memoryEPSS 0.4%CVE-2021-31989—A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump EPSS 0.4%CVE-2025-52579CRITICALEmerson ValveLink Products Cleartext Storage of Sensitive Information in MemoryEPSS 0.4%CVE-2024-33900MEDIUMKeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory dump. NOTE: the vendEPSS 0.3%CVE-2023-44153LOWSensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis CEPSS 0.3%CVE-2024-36792HIGHAn issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's pEPSS 0.3%CVE-2025-60794MEDIUMSession tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/useEPSS 0.2%CVE-2024-49800MEDIUMIBM ApplinX Information DisclosureEPSS 0.2%CVE-2024-39732MEDIUMIBM Datacap Navigator information disclosureEPSS 0.2%CVE-2021-32942MEDIUMThe vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorizEPSS 0.2%CVE-2024-24915MEDIUMSmartConsole Sensitive Credential Exposure via Memory DumpEPSS 0.2%CVE-2021-23182MEDIUMCleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be dEPSS 0.2%CVE-2022-0835HIGHAVEVA System Platform Cleartext Storage of Sensitive Information in MemoryEPSS 0.2%CVE-2024-35282LOWA cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versiEPSS 0.2%CVE-2026-8636MEDIUMMultiple Vulnerabilities in IBM DatacapEPSS 0.1%CVE-2025-65832MEDIUMThe mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has EPSS 0.1%