Fallos del tipo CWE-798

941 resultados

Credenciais codificadas no código-fonte

Senhas, chaves de API ou tokens de autenticação gravados diretamente no código-fonte ou configurações do aplicativo. O atacante que acessa o repositório, binário ou arquivo de configuração obtém acesso imediato aos sistemas protegidos, sem precisar quebrá-los.

Ejemplo

Um desenvolvedor inclui a senha do banco de dados como string literal no código: `const dbPassword = 'admin123';` ou em um arquivo .env commitado no Git. Qualquer pessoa com acesso ao repositório (público ou com vazamento) tem a senha de produção.

Cómo mitigar

Use variáveis de ambiente, gerenciadores de secrets (como Vault, AWS Secrets Manager, Azure Key Vault) e nunca commite credenciais no versionamento. Implemente escaneamento automático de repositórios para detectar padrões de credenciais e revogue chaves encontradas imediatamente.

CVE-2026-73519CRITICALWolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-SecretEPSS 0.8%CVE-2016-20026CRITICALZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code ExecutionEPSS 0.8%CVE-2024-41611CRITICALIn D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely tEPSS 0.8%CVE-2024-29063HIGHAzure AI Search Information Disclosure VulnerabilityEPSS 0.8%CVE-2025-35451CRITICALPan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabledEPSS 0.8%CVE-2022-44096CRITICALSanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and accessEPSS 0.8%CVE-2022-44097CRITICALBook Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access tEPSS 0.8%CVE-2026-57147CRITICALpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryEPSS 0.8%CVE-2026-47281CRITICALVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-38337CRITICALWhen aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid loginEPSS 0.8%CVE-2024-10025CRITICALVulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xxEPSS 0.8%CVE-2022-39273MEDIUMDefault OAuth Authorization Server secret in FlyteAdminEPSS 0.8%CVE-2023-35987CRITICALPiiGAB M-Bus Use of Hard-coded CredentialsEPSS 0.8%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2023-1269MEDIUMUse of Hard-coded Credentials in alextselegidis/easyappointmentsEPSS 0.7%CVE-2023-2138CRITICALUse of Hard-coded Credentials in nuxtlabs/github-moduleEPSS 0.7%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2023-39420CRITICALUse of Hard-coded Credentials in RDPCore.dllEPSS 0.7%CVE-2024-23816CRITICALA vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location IntelligenEPSS 0.7%CVE-2019-10995—ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phasEPSS 0.7%