Fallos del tipo CWE-540

31 resultados

Inclusão de Informações Sensíveis no Código-Fonte

Desenvolvedores deixam credenciais, chaves de API, tokens, senhas ou dados confidenciais hardcoded ou em comentários do código-fonte. Quando o repositório é exposto (vazamento de git, acesso não autorizado, fork público), essas informações ficam acessíveis a qualquer um, contornando completamente os controles de segurança.

Ejemplo

Um dev comita um arquivo `.env` ou deixa `api_key = "sk-1234abcd5678"` no meio do código Python. Um pesquisador de segurança ou atacante faz varredura no GitHub, encontra o repositório e reutiliza a chave para acessar serviços da empresa ou fazer requisições na API comprometida.

Cómo mitigar

Use variáveis de ambiente, arquivos `.env` marcados no `.gitignore`, ou gestores de secrets (Vault, AWS Secrets Manager, Doppler). Implementar scanning automático no pipeline CI/CD (ferramentas como TruffleHog, detect-secrets) para bloquear commits com padrões de credenciais antes que cheguem ao repositório.

CVE-2021-34638MEDIUMWordPress Download Manager <= 3.1.24 Authenticated Directory TraversalEPSS 1.3%CVE-2021-1516MEDIUMCisco Content Security Management Appliance, Email Security Appliance, and Web Security Appliance Information Disclosure VulnerabilityEPSS 1.2%CVE-2024-2265MEDIUMkeerti1924 PHP-MYSQL-User-Login-System login.sql inclusion of sensitive information in source codeEPSS 0.8%CVE-2023-23448MEDIUMInclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116,EPSS 0.8%CVE-2021-34744MEDIUMCisco Business 220 Series Smart Switches Static Key and Password VulnerabilitiesEPSS 0.7%CVE-2024-8417LOW云课网络科技有限公司 Yunke Online School System videobind.html sensitive information in sourceEPSS 0.7%CVE-2023-30802MEDIUMSangfor Next-Gen Application Firewall Source Code DisclosureEPSS 0.6%CVE-2024-38647HIGHQNAP AI CoreEPSS 0.6%CVE-2024-2355LOWkeerti1924 Secret-Coder-PHP-Project secret_coder.sql inclusion of sensitive information in source codeEPSS 0.6%CVE-2021-34757MEDIUMCisco Business 220 Series Smart Switches Static Key and Password VulnerabilitiesEPSS 0.6%CVE-2026-4155HIGHChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure VulnerabilityEPSS 0.6%CVE-2025-49182HIGHCredential disclosureEPSS 0.5%CVE-2024-39729MEDIUMIBM Datacap Navigator information disclosureEPSS 0.4%CVE-2025-26013HIGHAn issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component.EPSS 0.4%CVE-2024-1272HIGHInformation Disclosure to Source Code in TNB Mobile Solutions' Cockpit SoftwareEPSS 0.4%CVE-2025-3403MEDIUMVivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in sourceEPSS 0.4%CVE-2024-9596LOWInclusion of Sensitive Information in Source Code in GitLabEPSS 0.3%CVE-2025-23215CRITICALPMD Designer's release key passphrase (GPG) available on Maven Central in cleartextEPSS 0.3%CVE-2024-27257MEDIUMIBM OpenPages information disclosureEPSS 0.3%CVE-2026-45728HIGHAlgernon: Single-file mode unconditionally enables debug modeEPSS 0.3%