Falhas do tipo CWE-256

233 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2025-46366MEDIUMDell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation EPSS 0.1%CVE-2023-50945MEDIUMIBM Common Licensing information disclosureEPSS 0.1%CVE-2024-22432HIGH Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL DEPSS 0.1%CVE-2024-45638MEDIUMIBM QRadar EDR information disclosureEPSS 0.1%CVE-2024-53292HIGHDell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privilegedEPSS 0.1%CVE-2024-37135LOWDM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnEPSS 0.1%CVE-2026-14867MEDIUMInsecure password storage in User directoryEPSS 0.1%CVE-2024-43378HIGHcalamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systemsEPSS 0.1%CVE-2026-86715HIGHClear Text Storage of Password in Crypttech's Vatos DLPEPSS 0.1%CVE-2025-21111HIGHDell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with lEPSS 0.1%CVE-2026-44187LOWAnsible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api keyEPSS 0.1%CVE-2023-31002MEDIUMIBM Security Access Manager Container information disclosureEPSS 0.1%CVE-2024-25024MEDIUMIBM QRadar Suite Software information disclosureEPSS 0.1%CVE-2026-111491MEDIUMCredentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferencesEPSS 0.1%CVE-2026-22285MEDIUMDell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. A high privileged attacEPSS 0.1%CVE-2025-11193MEDIUMA potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sEPSS 0.1%CVE-2025-25051MEDIUMAutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a PasswordEPSS 0.1%CVE-2024-3082MEDIUMA “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to EPSS 0.1%CVE-2025-43938MEDIUMDell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high priviEPSS 0.1%CVE-2026-4243LOWLa Nacion App app.lanacion.activity BuildConfig.java credentials storageEPSS 0.1%