Falhas do tipo CWE-256

224 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2025-53656MEDIUMJenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in jobEPSS 0.4%CVE-2024-28782MEDIUMIBM QRadar Suite Software information disclosureEPSS 0.4%CVE-2026-33216HIGHNATS has MQTT plaintext password disclosureEPSS 0.4%CVE-2025-7357HIGHPlaintext Storage of a Password in LITEON IC48A and IC80A EV ChargersEPSS 0.4%CVE-2026-15933MEDIUMCleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)EPSS 0.4%CVE-2025-13221MEDIUMIntelbras UnniTI usuarios.xml credentials storageEPSS 0.4%CVE-2023-4400MEDIUM A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and cEPSS 0.4%CVE-2025-61680MEDIUMMinecraft RCON Terminal: Plain Text Password Storage in ConfigurationEPSS 0.4%CVE-2023-50956MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.4%CVE-2026-42151HIGHPrometheus Azure AD remote write OAuth client secret exposed via config APIEPSS 0.4%CVE-2024-55026HIGHAn issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrarEPSS 0.3%CVE-2024-4232MEDIUMPassword Storage in Plaintext Vulnerability in Digisol RouterEPSS 0.3%CVE-2024-3625HIGHMirror-registry: redis password stored in plain-textEPSS 0.3%CVE-2024-3624HIGHMirror-registry: database user and password stored in plain-textEPSS 0.3%CVE-2022-43958HIGHA vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are EPSS 0.3%CVE-2025-53664MEDIUMJenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the JeEPSS 0.3%CVE-2021-47961HIGHA plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence EPSS 0.3%CVE-2023-3395MEDIUM ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files EPSS 0.3%CVE-2026-6597MEDIUMlangflow-ai langflow Flow Using API core.py has_api_terms credentials storageEPSS 0.3%CVE-2025-53655MEDIUMJenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potenEPSS 0.3%