Fallos del tipo CWE-798

945 resultados

Credenciais codificadas no código-fonte

Senhas, chaves de API ou tokens de autenticação gravados diretamente no código-fonte ou configurações do aplicativo. O atacante que acessa o repositório, binário ou arquivo de configuração obtém acesso imediato aos sistemas protegidos, sem precisar quebrá-los.

Ejemplo

Um desenvolvedor inclui a senha do banco de dados como string literal no código: `const dbPassword = 'admin123';` ou em um arquivo .env commitado no Git. Qualquer pessoa com acesso ao repositório (público ou com vazamento) tem a senha de produção.

Cómo mitigar

Use variáveis de ambiente, gerenciadores de secrets (como Vault, AWS Secrets Manager, Azure Key Vault) e nunca commite credenciais no versionamento. Implemente escaneamento automático de repositórios para detectar padrões de credenciais e revogue chaves encontradas imediatamente.

CVE-2021-39613HIGHD-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/pEPSS 1.7%CVE-2024-23619CRITICALIBM Merge Healthcare eFilm Workstation Hardcoded CredentialsEPSS 1.7%CVE-2024-8162CRITICALTOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentialsEPSS 1.7%CVE-2020-10270CRITICALRVD#2557: Hardcoded Credentials on MiRX00 Control DashboardEPSS 1.7%CVE-2019-19108CRITICALB&R Automation Runtime SNMP Authentication and Authorization WeaknessEPSS 1.6%CVE-2018-5560CRITICALGuardzilla All-In-One Video Security System Hard-Coded CredentialEPSS 1.6%CVE-2018-5551CRITICALDocuTrac DTISQLInstaller.exe Hard-Coded CredentialsEPSS 1.6%CVE-2026-2616HIGHBeetel 777VR1 Web Management hard-coded credentialsEPSS 1.6%CVE-2019-0020CRITICALJuniper ATP: Hard coded credentials used in Web CollectorEPSS 1.6%CVE-2020-3165HIGHCisco NX-OS Software Border Gateway Protocol MD5 Authentication Bypass VulnerabilityEPSS 1.6%CVE-2022-30997MEDIUMUse of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker EPSS 1.6%CVE-2012-6428—Carlo Gavazzi EOS Box Hard-Coded CredentialsEPSS 1.5%CVE-2020-5248HIGHPublic GLPIKEY can be used to decrypt any data in GLPIEPSS 1.5%CVE-2022-46637CRITICALProlink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.EPSS 1.5%CVE-2020-10276CRITICALRVD#2558: Default credentials on SICK PLC allows disabling safety featuresEPSS 1.5%CVE-2018-15720—Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the localEPSS 1.5%CVE-2023-36013MEDIUMPowerShell Information Disclosure VulnerabilityEPSS 1.4%CVE-2022-32965CRITICALITPison OMICARD EDM - Use of Hard-coded CredentialsEPSS 1.4%CVE-2021-32535CRITICALQSAN SANOS - Use of Hard-coded CredentialsEPSS 1.4%CVE-2020-3446CRITICALCisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials VulnerabilityEPSS 1.4%