Fallos del tipo CWE-798

945 resultados

Credenciais codificadas no código-fonte

Senhas, chaves de API ou tokens de autenticação gravados diretamente no código-fonte ou configurações do aplicativo. O atacante que acessa o repositório, binário ou arquivo de configuração obtém acesso imediato aos sistemas protegidos, sem precisar quebrá-los.

Ejemplo

Um desenvolvedor inclui a senha do banco de dados como string literal no código: `const dbPassword = 'admin123';` ou em um arquivo .env commitado no Git. Qualquer pessoa com acesso ao repositório (público ou com vazamento) tem a senha de produção.

Cómo mitigar

Use variáveis de ambiente, gerenciadores de secrets (como Vault, AWS Secrets Manager, Azure Key Vault) e nunca commite credenciais no versionamento. Implemente escaneamento automático de repositórios para detectar padrões de credenciais e revogue chaves encontradas imediatamente.

CVE-2026-57147CRITICALpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryEPSS 0.8%CVE-2026-19901CRITICALLB-LINK X-PRO easycwmp hard-coded credentialsEPSS 0.8%CVE-2026-47281CRITICALVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-38337CRITICALWhen aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid loginEPSS 0.8%CVE-2024-10025CRITICALVulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xxEPSS 0.8%CVE-2022-39273MEDIUMDefault OAuth Authorization Server secret in FlyteAdminEPSS 0.8%CVE-2023-35987CRITICALPiiGAB M-Bus Use of Hard-coded CredentialsEPSS 0.8%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2023-1269MEDIUMUse of Hard-coded Credentials in alextselegidis/easyappointmentsEPSS 0.7%CVE-2023-2138CRITICALUse of Hard-coded Credentials in nuxtlabs/github-moduleEPSS 0.7%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2023-39420CRITICALUse of Hard-coded Credentials in RDPCore.dllEPSS 0.7%CVE-2024-23816CRITICALA vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location IntelligenEPSS 0.7%CVE-2019-10995—ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phasEPSS 0.7%CVE-2025-46352CRITICALConsilium Safety CS5000 Fire Panel Use of Hard-coded CredentialsEPSS 0.7%CVE-2021-33540HIGHPhoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devicesEPSS 0.7%CVE-2024-8005MEDIUMdemozx gf_cms JWT Authentication auth.go init hard-coded credentialsEPSS 0.7%CVE-2024-1039CRITICALUse of Hard-coded Credentials in Gessler GmbH WEB-MASTEREPSS 0.7%CVE-2021-33531HIGHWEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerabilityEPSS 0.7%CVE-2025-26410CRITICALWeak Hard-coded CredentialsEPSS 0.7%