Falhas do tipo CWE-256

232 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2024-25052MEDIUMIBM Jazz Reporting Service information disclosureEPSS 0.2%CVE-2025-25727MEDIUMBosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.EPSS 0.2%CVE-2025-34210CRITICALVasion Print (formerly PrinterLogic) Readable Cleartext PasswordsEPSS 0.2%CVE-2025-2355MEDIUMBlackVue App API Endpoint credentials storageEPSS 0.2%CVE-2021-38489HIGHHDD Password Stored In PlaintextEPSS 0.2%CVE-2024-21869MEDIUMPlaintext Storage of a Password in Rapid SCADAEPSS 0.2%CVE-2025-36258HIGHIBM InfoSphere Information Server is vulnerable due to plaintext storage of a passwordEPSS 0.2%CVE-2024-22312MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.2%CVE-2019-0072MEDIUMSBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.EPSS 0.2%CVE-2021-43590MEDIUMDell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability.EPSS 0.2%CVE-2025-36002MEDIUMIBM Sterling B2B Integrator information disclosureEPSS 0.1%CVE-2024-28961MEDIUMDell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged maliEPSS 0.1%CVE-2018-25130MEDIUMBeward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted DatabaseEPSS 0.1%CVE-2024-49351MEDIUMIBM Workload Scheduler information disclosureEPSS 0.1%CVE-2020-3483HIGHDuo Network Gateway (DNG) Information Disclosure VulnerabilityEPSS 0.1%CVE-2024-28325MEDIUMAsus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router seEPSS 0.1%CVE-2024-39733MEDIUMIBM Datacap Navigator information disclosureEPSS 0.1%CVE-2024-20489HIGHCisco Routed Passive Optical Network Cleartext Password VulnerabilityEPSS 0.1%CVE-2024-10334HIGHCamera passwords stored in clear textEPSS 0.1%CVE-2026-36174MEDIUMGNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial consoleEPSS 0.1%