Fallos del tipo CWE-798

945 resultados

Credenciais codificadas no código-fonte

Senhas, chaves de API ou tokens de autenticação gravados diretamente no código-fonte ou configurações do aplicativo. O atacante que acessa o repositório, binário ou arquivo de configuração obtém acesso imediato aos sistemas protegidos, sem precisar quebrá-los.

Ejemplo

Um desenvolvedor inclui a senha do banco de dados como string literal no código: `const dbPassword = 'admin123';` ou em um arquivo .env commitado no Git. Qualquer pessoa com acesso ao repositório (público ou com vazamento) tem a senha de produção.

Cómo mitigar

Use variáveis de ambiente, gerenciadores de secrets (como Vault, AWS Secrets Manager, Azure Key Vault) e nunca commite credenciais no versionamento. Implemente escaneamento automático de repositórios para detectar padrões de credenciais e revogue chaves encontradas imediatamente.

CVE-2021-33016CRITICALKUKA KR C4 - Use of Hard-Coded CredentialsEPSS 1.0%CVE-2023-37286CRITICALSmartBPM.NET - Use of Hard-Coded Credentials - 1EPSS 1.0%CVE-2022-23402—The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 aEPSS 1.0%CVE-2017-13104—Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13100—DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13108—DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13101—Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13102—Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13106—Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2026-42374CRITICALD-Link DIR-600L B1 Hardcoded Telnet Backdoor CredentialsEPSS 1.0%CVE-2026-42373CRITICALD-Link DIR-605L B2 Hardcoded Telnet Backdoor CredentialsEPSS 1.0%CVE-2026-42375CRITICALD-Link DIR-600L A1 Hardcoded Telnet Backdoor CredentialsEPSS 1.0%CVE-2022-26671HIGHTAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded CredentialsEPSS 1.0%CVE-2018-0039MEDIUMContrail Service Orchestration: Hardcoded credentials for Grafana serviceEPSS 1.0%CVE-2023-33236CRITICALMXsecurity Hardcoded Credential VulnerabilityEPSS 1.0%CVE-2022-21194—The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUMEPSS 1.0%CVE-2026-67614CRITICALCyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminalEPSS 1.0%CVE-2020-3318HIGHCisco Firepower Management Center Static Credential VulnerabilitiesEPSS 1.0%CVE-2023-25187MEDIUMAn issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factEPSS 1.0%CVE-2017-13107—Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryptionEPSS 1.0%