Fallos del tipo CWE-522

691 resultados

Credenciais Insuficientemente Protegidas

É quando senhas, tokens ou chaves de acesso são armazenados ou transmitidos sem criptografia adequada, em texto plano ou com proteção fraca. O atacante que ganhar acesso ao código-fonte, banco de dados ou rede consegue ler as credenciais diretamente e entrar no sistema.

Ejemplo

Um desenvolvedor deixa a senha do banco de dados hardcoded em um arquivo .env versionado no Git, ou a API transmite tokens de autenticação por HTTP ao invés de HTTPS. Qualquer pessoa com acesso ao repositório ou monitorando a rede consegue roubar as credenciais.

Cómo mitigar

Use variáveis de ambiente ou gerenciadores de segredos (como HashiCorp Vault, AWS Secrets Manager); nunca versione credenciais. Sempre transmita sobre HTTPS, aplique hash com salt para senhas armazenadas, e implemente expiração e rotação de tokens e chaves.

CVE-2025-62327MEDIUMHCL DevOps Deploy is susceptible to insufficiently protected credentialsEPSS 0.3%CVE-2026-16104MEDIUMKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminsEPSS 0.3%CVE-2026-72857HIGHBudibase before 3.40.0 Credential Exposure via STRING FieldsEPSS 0.3%CVE-2024-24595MEDIUMAllegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaEPSS 0.3%CVE-2026-49379MEDIUMIn JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesEPSS 0.3%CVE-2025-12636HIGHUbia UboxEPSS 0.3%CVE-2026-12984HIGHExposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601EPSS 0.3%CVE-2026-85720MEDIUMAsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT requestEPSS 0.3%CVE-2021-34700MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-16553MEDIUMInsufficiently Protected Credentials in GitLabEPSS 0.3%CVE-2026-49949MEDIUMCodexBar < 0.33.0 Credential Leakage via HTTP RedirectEPSS 0.3%CVE-2026-29872HIGHA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab82EPSS 0.3%CVE-2021-33107MEDIUMInsufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and InEPSS 0.3%CVE-2026-46440HIGHFlowise: Basic Auth Credentials Exposed via APIEPSS 0.3%CVE-2026-48976HIGHHomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook HijackEPSS 0.3%CVE-2026-72794CRITICALsiyuan before v3.7.4 Session Cookie Key Disclosure via getConfEPSS 0.2%CVE-2025-54467MEDIUMNeuVector process with sensitive arguments lead to leakageEPSS 0.2%CVE-2020-7306MEDIUMDLP for Mac - Unprotected Storage of CredentialsEPSS 0.2%CVE-2021-3681—A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explEPSS 0.2%CVE-2026-7017HIGHHTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targetsEPSS 0.2%