Fallos del tipo CWE-798

941 resultados

Credenciais codificadas no código-fonte

Senhas, chaves de API ou tokens de autenticação gravados diretamente no código-fonte ou configurações do aplicativo. O atacante que acessa o repositório, binário ou arquivo de configuração obtém acesso imediato aos sistemas protegidos, sem precisar quebrá-los.

Ejemplo

Um desenvolvedor inclui a senha do banco de dados como string literal no código: `const dbPassword = 'admin123';` ou em um arquivo .env commitado no Git. Qualquer pessoa com acesso ao repositório (público ou com vazamento) tem a senha de produção.

Cómo mitigar

Use variáveis de ambiente, gerenciadores de secrets (como Vault, AWS Secrets Manager, Azure Key Vault) e nunca commite credenciais no versionamento. Implemente escaneamento automático de repositórios para detectar padrões de credenciais e revogue chaves encontradas imediatamente.

CVE-2022-29778HIGHD-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' atEPSS 2.7%CVE-2021-31477MEDIUMThis vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is EPSS 2.6%CVE-2026-56265CRITICALCrawl4AI - Authentication Bypass via Hardcoded JWT Signing KeyEPSS 2.6%CVE-2019-1675HIGHCisco Aironet Active Sensor Static Credentials VulnerabilityEPSS 2.6%CVE-2020-3158CRITICALCisco Smart Software Manager On-Prem Static Default Credential VulnerabilityEPSS 2.6%CVE-2017-14027—A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FXEPSS 2.5%CVE-2019-13657CRITICALCA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote EPSS 2.5%CVE-2024-5471HIGHAgent takeoverEPSS 2.5%CVE-2014-125115CRITICALPandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCEEPSS 2.5%CVE-2021-40390CRITICALAn authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP reqEPSS 2.5%CVE-2023-20101CRITICALA vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root EPSS 2.4%CVE-2022-22722—A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain theEPSS 2.4%CVE-2018-0329—A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application ServiceEPSS 2.4%CVE-2023-44411CRITICALD-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass VulnerabilityEPSS 2.4%CVE-2019-13553—Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected syEPSS 2.3%CVE-2020-3382CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilityEPSS 2.3%CVE-2020-6981—In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.EPSS 2.3%CVE-2022-22056CRITICALLe-yan Co., Ltd. dental management system - Hard-coded CredentialsEPSS 2.3%CVE-2026-19900CRITICALLB-LINK X-PRO shadow hard-coded credentialsEPSS 2.2%CVE-2024-9486CRITICALVM images built with Image Builder and Proxmox provider use default credentialsEPSS 2.2%