Fallos del tipo CWE-798

943 resultados

Credenciais codificadas no código-fonte

Senhas, chaves de API ou tokens de autenticação gravados diretamente no código-fonte ou configurações do aplicativo. O atacante que acessa o repositório, binário ou arquivo de configuração obtém acesso imediato aos sistemas protegidos, sem precisar quebrá-los.

Ejemplo

Um desenvolvedor inclui a senha do banco de dados como string literal no código: `const dbPassword = 'admin123';` ou em um arquivo .env commitado no Git. Qualquer pessoa com acesso ao repositório (público ou com vazamento) tem a senha de produção.

Cómo mitigar

Use variáveis de ambiente, gerenciadores de secrets (como Vault, AWS Secrets Manager, Azure Key Vault) e nunca commite credenciais no versionamento. Implemente escaneamento automático de repositórios para detectar padrões de credenciais e revogue chaves encontradas imediatamente.

CVE-2025-13252MEDIUMshsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentialsEPSS 0.3%CVE-2026-77847HIGHTycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded CredentialsEPSS 0.3%CVE-2019-5139MEDIUMAn exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. ThEPSS 0.3%CVE-2026-6578MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2023-49223HIGHPrecor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is storEPSS 0.3%CVE-2019-1919HIGHCisco FindIT Network Management Software Static Credentials VulnerabilityEPSS 0.3%CVE-2017-20214CRITICALFLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 Hard-Coded SSH Credentials VulnerabilityEPSS 0.3%CVE-2021-47744CRITICALCypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote RootEPSS 0.3%CVE-2026-22900MEDIUMQuNetSwitchEPSS 0.3%CVE-2025-36752CRITICALUndocumented backup Account and No Password Configuration CapabilityEPSS 0.3%CVE-2025-36747CRITICALHardcoded FTP Credentials within the firmwareEPSS 0.3%CVE-2022-38069MEDIUMContec Health CMS8000EPSS 0.3%CVE-2025-9497MEDIUMHardcoded Upgrade Decryption PasswordsEPSS 0.3%CVE-2024-49806CRITICALIBM Security Verify Access Appliance hard coded credentialsEPSS 0.3%CVE-2023-49222HIGHPrecor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to EPSS 0.3%CVE-2024-1661LOWTotolink X6000R shadow hard-coded credentialsEPSS 0.3%CVE-2026-47847MEDIUMBitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatioEPSS 0.3%CVE-2025-66454MEDIUMArcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsEPSS 0.3%CVE-2025-4378CRITICALHardcoded Credentials in Ataturk University's ATA-AOF Mobile ApplicationEPSS 0.3%CVE-2023-28897MEDIUMHard-coded password for UDS servicesEPSS 0.3%