Fallos del tipo CWE-522

689 resultados

Credenciais Insuficientemente Protegidas

É quando senhas, tokens ou chaves de acesso são armazenados ou transmitidos sem criptografia adequada, em texto plano ou com proteção fraca. O atacante que ganhar acesso ao código-fonte, banco de dados ou rede consegue ler as credenciais diretamente e entrar no sistema.

Ejemplo

Um desenvolvedor deixa a senha do banco de dados hardcoded em um arquivo .env versionado no Git, ou a API transmite tokens de autenticação por HTTP ao invés de HTTPS. Qualquer pessoa com acesso ao repositório ou monitorando a rede consegue roubar as credenciais.

Cómo mitigar

Use variáveis de ambiente ou gerenciadores de segredos (como HashiCorp Vault, AWS Secrets Manager); nunca versione credenciais. Sempre transmita sobre HTTPS, aplique hash com salt para senhas armazenadas, e implemente expiração e rotação de tokens e chaves.

CVE-2026-62213MEDIUMOpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound RequestsEPSS 0.4%CVE-2026-62208MEDIUMOpenClaw < 2026.6.5 Authorization Header Forwarding via SSEEPSS 0.4%CVE-2026-78555CRITICALRansomLook API Key Disclosure Through /admin/apikeys HTML SourceEPSS 0.4%CVE-2019-3782MEDIUMCredHub CLI writes environment variable credentials to diskEPSS 0.4%CVE-2026-42295HIGHArgo Workflows: Exposure of artifact repository credentialsEPSS 0.4%CVE-2026-35185HIGHHAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addressesEPSS 0.4%CVE-2024-47162MEDIUMIn JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageEPSS 0.4%CVE-2026-71862HIGHCheckmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is EnabledEPSS 0.4%CVE-2025-58366CRITICALOnyxia private helm repository credentials are leaked through unauthenticated APIEPSS 0.4%CVE-2026-92882LOWRedact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responsesEPSS 0.4%CVE-2026-24845MEDIUMmalcontent's OCI image scanning could expose registry credentialsEPSS 0.4%CVE-2026-75960HIGHInsufficiently Protected Credentials in Rently Smart HomeEPSS 0.4%CVE-2023-27126MEDIUMThe AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An atEPSS 0.4%CVE-2025-65098HIGHTypebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization BypassEPSS 0.3%CVE-2025-67732HIGHDify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration EndpointEPSS 0.3%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.3%CVE-2026-76859HIGHNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgiEPSS 0.3%CVE-2026-76857HIGHNetcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgiEPSS 0.3%CVE-2025-52095CRITICALAn issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dllEPSS 0.3%CVE-2026-53454MEDIUMBlueprint Studio stored Git credentials in plaintext Git credential storeEPSS 0.3%