Falhas do tipo CWE-255

62 resultados

Erros na Gestão de Credenciais

Fraqueza genérica que abrange falhas no armazenamento, transmissão ou validação de credenciais (senhas, tokens, chaves API). O software não protege adequadamente essas informações sensíveis, permitindo que um atacante as intercepte, recupere ou reutilize para ganhar acesso não autorizado.

Exemplo

Uma aplicação que transmite senha em texto plano via HTTP, armazena tokens de autenticação em cookies sem flag HttpOnly, ou valida credenciais contra um banco de dados sem hash. Um atacante na rede ou com acesso ao banco pode roubar essas credenciais e se passar pelo usuário legítimo.

Como mitigar

Use HTTPS/TLS para toda transmissão de credenciais, armazene senhas com algoritmos de hash forte (bcrypt, Argon2), implemente flags de segurança em cookies (HttpOnly, Secure, SameSite), nunca registre credenciais em logs, e valide credenciais de forma consistente em cada requisição autenticada.

CVE-2025-15151MEDIUMTaleLin Lin-CMS Tests Folder config.py password in configuration fileEPSS 0.3%CVE-2020-1978MEDIUMVM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMsEPSS 0.3%CVE-2025-15128MEDIUMZKTeco BioTime Endpoint safe_setting credentials storageEPSS 0.3%CVE-2026-11552MEDIUMSourceCodester Onlne Examination & Learning Management System import_users.php hard-coded passwordEPSS 0.3%CVE-2020-24680HIGHImproper Credential Storage in Symphony PlusEPSS 0.3%CVE-2026-11515MEDIUMSourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded passwordEPSS 0.3%CVE-2020-8968HIGHParallels Remote Application Server credentials management errorsEPSS 0.3%CVE-2025-14183MEDIUMSGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storageEPSS 0.3%CVE-2021-21522HIGHDell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain aEPSS 0.2%CVE-2021-28498HIGHIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text coEPSS 0.2%CVE-2021-28499MEDIUMIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text cEPSS 0.2%CVE-2025-2555LOWAudi Universal Traffic Recorder App FTP Credentials hard-coded passwordEPSS 0.2%CVE-2025-11666HIGHTenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordEPSS 0.2%CVE-2025-2355MEDIUMBlackVue App API Endpoint credentials storageEPSS 0.2%CVE-2021-37000HIGHSome Huawei wearables have a permission management vulnerability.EPSS 0.1%CVE-2025-11649HIGHTomofun Furbo 360/Furbo Mini Root Account hard-coded passwordEPSS 0.1%CVE-2022-25327MEDIUMLocal Denial of Service in fscrypt PAM moduleEPSS 0.1%CVE-2026-4243LOWLa Nacion App app.lanacion.activity BuildConfig.java credentials storageEPSS 0.1%CVE-2026-4242LOWBabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storageEPSS 0.1%CVE-2026-4250LOWAlbert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storageEPSS 0.1%