Fallos del tipo CWE-798

945 resultados

Credenciais codificadas no código-fonte

Senhas, chaves de API ou tokens de autenticação gravados diretamente no código-fonte ou configurações do aplicativo. O atacante que acessa o repositório, binário ou arquivo de configuração obtém acesso imediato aos sistemas protegidos, sem precisar quebrá-los.

Ejemplo

Um desenvolvedor inclui a senha do banco de dados como string literal no código: `const dbPassword = 'admin123';` ou em um arquivo .env commitado no Git. Qualquer pessoa com acesso ao repositório (público ou com vazamento) tem a senha de produção.

Cómo mitigar

Use variáveis de ambiente, gerenciadores de secrets (como Vault, AWS Secrets Manager, Azure Key Vault) e nunca commite credenciais no versionamento. Implemente escaneamento automático de repositórios para detectar padrões de credenciais e revogue chaves encontradas imediatamente.

CVE-2026-1612MEDIUMHard-coded AWS Key in AL-KO Robolinho Update SoftwareEPSS 0.4%CVE-2026-24448CRITICALUse of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access.EPSS 0.4%CVE-2024-5764MEDIUMNexus Repository 3 - Static hard-coded encryption passphrase used by defaultEPSS 0.4%CVE-2026-16141HIGHOpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge ValueEPSS 0.4%CVE-2019-25470HIGHeWON Firmware 12.2-13.0 Authentication Bypass via wsdReadFormEPSS 0.4%CVE-2024-38281HIGHUse of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)EPSS 0.4%CVE-2025-10560CRITICALHardcoded cloud credentials in Worksnaps client application binaries expose production cloud resourcesEPSS 0.4%CVE-2024-37630HIGHD-Link DIR-605L v2.13B01 was discovered to contain a hardcoded password vulnerability in /etc/passwd, which allows attackers to log in as roEPSS 0.4%CVE-2026-18164HIGHFlow Neuroscience FL-100 Use of Hard-coded CredentialsEPSS 0.4%CVE-2024-8450HIGHPLANET Technology switch devices - Hard-coded SNMPv1 read-write community stringEPSS 0.4%CVE-2023-40236MEDIUMIn Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authenticatEPSS 0.4%CVE-2025-41710MEDIUMUse of Hard-coded Credentials in power analyzerEPSS 0.4%CVE-2023-4204MEDIUMNPort IAW5000A-I/O Series Hardcoded Credential VulnerabilityEPSS 0.4%CVE-2024-22813MEDIUMAn issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memoEPSS 0.4%CVE-2026-48244MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.phpEPSS 0.4%CVE-2026-48243MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.phpEPSS 0.4%CVE-2026-48245MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.phpEPSS 0.4%CVE-2025-27488MEDIUMMicrosoft Windows Hardware Lab Kit (HLK) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-13463HIGHDue to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []EPSS 0.4%CVE-2026-13446CRITICALLangflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpointsEPSS 0.4%