Falhas do tipo CWE-256

233 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2023-50956MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.4%CVE-2024-4232MEDIUMPassword Storage in Plaintext Vulnerability in Digisol RouterEPSS 0.3%CVE-2024-3625HIGHMirror-registry: redis password stored in plain-textEPSS 0.3%CVE-2024-3624HIGHMirror-registry: database user and password stored in plain-textEPSS 0.3%CVE-2025-33079MEDIUMIBM Controller information disclosureEPSS 0.3%CVE-2021-47961HIGHA plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence EPSS 0.3%CVE-2023-43777MEDIUMInsecure storage of password in easySoftEPSS 0.3%CVE-2023-3395MEDIUM ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files EPSS 0.3%CVE-2025-31724MEDIUMJenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files EPSS 0.3%CVE-2018-25396HIGHHeatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htmEPSS 0.3%CVE-2023-39227MEDIUM​Softneta MedDream PACS Plaintext Storage of a PasswordEPSS 0.3%CVE-2022-33928MEDIUMDell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges coulEPSS 0.3%CVE-2025-25985LOWAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execEPSS 0.3%CVE-2025-53665MEDIUMJenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration forEPSS 0.3%CVE-2022-3644MEDIUMThe collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write modEPSS 0.3%CVE-2026-35556CRITICALPlaintext storage of a password in OpenPLC_V3EPSS 0.3%CVE-2025-53677MEDIUMJenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential forEPSS 0.3%CVE-2025-53674MEDIUMJenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, inEPSS 0.3%CVE-2020-37115HIGHGUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password StorageEPSS 0.3%CVE-2019-19105MEDIUMABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentialsEPSS 0.3%