Falhas do tipo CWE-256

224 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2019-0072MEDIUMSBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.EPSS 0.2%CVE-2021-43590MEDIUMDell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability.EPSS 0.2%CVE-2025-36002MEDIUMIBM Sterling B2B Integrator information disclosureEPSS 0.1%CVE-2024-28961MEDIUMDell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged maliEPSS 0.1%CVE-2018-25130MEDIUMBeward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted DatabaseEPSS 0.1%CVE-2024-28325MEDIUMAsus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router seEPSS 0.1%CVE-2020-3483HIGHDuo Network Gateway (DNG) Information Disclosure VulnerabilityEPSS 0.1%CVE-2024-49351MEDIUMIBM Workload Scheduler information disclosureEPSS 0.1%CVE-2024-20489HIGHCisco Routed Passive Optical Network Cleartext Password VulnerabilityEPSS 0.1%CVE-2024-39733MEDIUMIBM Datacap Navigator information disclosureEPSS 0.1%CVE-2024-10334HIGHCamera passwords stored in clear textEPSS 0.1%CVE-2026-36174MEDIUMGNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial consoleEPSS 0.1%CVE-2023-50945MEDIUMIBM Common Licensing information disclosureEPSS 0.1%CVE-2024-22432HIGH Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL DEPSS 0.1%CVE-2024-53292HIGHDell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privilegedEPSS 0.1%CVE-2024-45638MEDIUMIBM QRadar EDR information disclosureEPSS 0.1%CVE-2026-41874MEDIUMHard-coded admin credentials in Quick.CartEPSS 0.1%CVE-2024-37135LOWDM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnEPSS 0.1%CVE-2026-14867MEDIUMInsecure password storage in User directoryEPSS 0.1%CVE-2024-43378HIGHcalamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systemsEPSS 0.1%