Falhas do tipo CWE-256

215 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2024-28736HIGHAn issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function.EPSS 2.5%CVE-2019-10921—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of passwords in the proEPSS 2.4%CVE-2017-16714—In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible withoutEPSS 2.4%CVE-2024-26165HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 1.9%CVE-2020-8183—A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.EPSS 1.9%CVE-2020-6961—In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XEPSS 1.6%CVE-2020-10609—Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system seEPSS 1.5%CVE-2018-7510—In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords areEPSS 1.4%CVE-2018-8851CRITICALEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versionsEPSS 1.3%CVE-2024-29978MEDIUMUser passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump fiEPSS 1.3%CVE-2017-6049—Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL.EPSS 1.3%CVE-2019-6518—Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.EPSS 1.2%CVE-2017-7913—A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3EPSS 1.2%CVE-2023-0457HIGHInformation Disclosure Vulnerability in MELSEC SeriesEPSS 1.2%CVE-2020-5374HIGHDell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptoEPSS 1.0%CVE-2021-32978HIGHAutomation Direct CLICK PLC CPU Modules Plaintext Storage of a PasswordEPSS 1.0%CVE-2021-1589MEDIUMCisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure VulnerabilityEPSS 1.0%CVE-2020-26079MEDIUMCisco IoT Field Network Director Unprotected Storage of Credentials VulnerabilityEPSS 1.0%CVE-2025-27656CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2EPSS 0.9%CVE-2024-43659HIGHPlaintext default credentials in firmwareEPSS 0.8%