Fallos del tipo CWE-522

689 resultados

Credenciais Insuficientemente Protegidas

É quando senhas, tokens ou chaves de acesso são armazenados ou transmitidos sem criptografia adequada, em texto plano ou com proteção fraca. O atacante que ganhar acesso ao código-fonte, banco de dados ou rede consegue ler as credenciais diretamente e entrar no sistema.

Ejemplo

Um desenvolvedor deixa a senha do banco de dados hardcoded em um arquivo .env versionado no Git, ou a API transmite tokens de autenticação por HTTP ao invés de HTTPS. Qualquer pessoa com acesso ao repositório ou monitorando a rede consegue roubar as credenciais.

Cómo mitigar

Use variáveis de ambiente ou gerenciadores de segredos (como HashiCorp Vault, AWS Secrets Manager); nunca versione credenciais. Sempre transmita sobre HTTPS, aplique hash com salt para senhas armazenadas, e implemente expiração e rotação de tokens e chaves.

CVE-2018-17900—Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentiaEPSS 1.9%CVE-2025-28228HIGHA credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 EPSS 1.8%CVE-2022-27774MEDIUMAn insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attackeEPSS 1.8%CVE-2022-0718—A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debugEPSS 1.7%CVE-2019-10960—Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option tEPSS 1.7%CVE-2022-4693CRITICALUser Verification < 1.0.94 - Authentication Bypass EPSS 1.6%CVE-2019-10214MEDIUMThe containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenEPSS 1.6%CVE-2017-6046—An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink EPSS 1.6%CVE-2019-10206MEDIUMansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passEPSS 1.5%CVE-2019-9533—The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08EPSS 1.5%CVE-2021-23222—A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification aEPSS 1.5%CVE-2021-41972—Credentials leakEPSS 1.5%CVE-2020-25235—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The password used for authentication for thEPSS 1.4%CVE-2020-2499MEDIUMHard-coded Password Vulnerability in QESEPSS 1.4%CVE-2025-26628HIGHAzure Local Cluster Information Disclosure VulnerabilityEPSS 1.4%CVE-2019-6525—AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and iEPSS 1.3%CVE-2018-7518—In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the intEPSS 1.3%CVE-2021-35529HIGHPassword in Memory Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)EPSS 1.3%CVE-2017-7524—tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when geneEPSS 1.2%CVE-2021-22132—Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search wilEPSS 1.2%