Falhas do tipo CWE-256

224 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2019-0032MEDIUMJunos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files.EPSS 0.4%CVE-2024-39220MEDIUMBAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-EPSS 0.4%CVE-2020-25184HIGHRockwell Automation ISaGRAF5 Runtime Unprotected Storage of CredentialsEPSS 0.4%CVE-2024-5960CRITICALPlaintext Storage of a Password in Eliz Software's PanelEPSS 0.4%CVE-2023-26204LOWA plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versionEPSS 0.4%CVE-2026-46513HIGHFrogman: API tokens stored in plaintextEPSS 0.4%CVE-2024-3623MEDIUMMirror-registry: default database secret key stored in plain-text on initial configuration fileEPSS 0.4%CVE-2025-56527HIGHPlaintext password storage in Kotaemon 0.11.0 in the client's localStorage.EPSS 0.4%CVE-2023-42493HIGH EisBaer Scada - CWE-256: Plaintext Storage of a PasswordEPSS 0.4%CVE-2024-40116HIGHAn issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html,EPSS 0.4%CVE-2024-41336HIGHDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior EPSS 0.4%CVE-2023-48700MEDIUMClear Text Credentials Exposed via Onboarding TaskEPSS 0.4%CVE-2023-2633MEDIUMAPI keys stored and displayed in plain text by Code Dx Plugin EPSS 0.4%CVE-2024-25138MEDIUMAutomationDirect C-MORE EA9 HMI Plaintext Storage of a PasswordEPSS 0.4%CVE-2023-41610HIGHVicture PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.EPSS 0.4%CVE-2026-40430HIGHPlaintext Storage of a Password in Panduit IntraVUE by PronetiqsEPSS 0.4%CVE-2024-4425MEDIUMStoring credentials in plaintext in CemiParkEPSS 0.4%CVE-2025-2500CRITICALA vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gaiEPSS 0.4%CVE-2025-15624CRITICALPlaintext Storage of a Password in Sparx Pro Cloud Server.EPSS 0.4%CVE-2025-1709MEDIUMCVE-2025-1709EPSS 0.4%