Falhas do tipo CWE-256

233 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2024-36081CRITICALWestermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. EPSS 0.6%CVE-2024-23486CRITICALPlaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker wiEPSS 0.6%CVE-2024-36464LOWMedia Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exportedEPSS 0.6%CVE-2025-6561CRITICALHunt Electronic Hybrid DVR - Exposure of Sensitive System InformationEPSS 0.5%CVE-2026-15933MEDIUMCleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)EPSS 0.5%CVE-2024-52361MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.5%CVE-2025-4286MEDIUMIntelbras InControl Dispositivos Edição Page credentials storageEPSS 0.5%CVE-2023-35067HIGHPlaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval SystemEPSS 0.5%CVE-2025-48046MEDIUMMICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in CleartextEPSS 0.5%CVE-2024-3622HIGHMirror-registry: plain-text default csrf secret keyEPSS 0.5%CVE-2024-49370HIGHChange-Password via Portal-Profile sets PimcoreBackendUser password without hashingEPSS 0.5%CVE-2022-27548MEDIUMHCL Launch is vulnerable to information disclosure which can be read by a local user.EPSS 0.5%CVE-2023-35765MEDIUMPiiGAB M-Bus Plaintext Storage of a PasswordEPSS 0.5%CVE-2026-55765HIGHCloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database podEPSS 0.5%CVE-2025-5893CRITICALHonding Technology Smart Parking Management System - Exposure of Sensitive InformationEPSS 0.5%CVE-2023-42493HIGH EisBaer Scada - CWE-256: Plaintext Storage of a PasswordEPSS 0.5%CVE-2025-2770MEDIUMBEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-6118CRITICALHamastar MeetingHub Paperless Meetings - Plaintext Storage of a PasswordEPSS 0.5%CVE-2023-22389MEDIUM Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported viaEPSS 0.5%CVE-2025-15113CRITICALKsenia Security lares Home Automation 1.6 Remote Code Execution via MPFS UploadEPSS 0.5%