Falhas do tipo CWE-256

233 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2018-7515—In Omron CX-Supervisor Versions 3.30 and prior, access of uninitialized pointer vulnerabilities can be exploited when CX Supervisor indirectEPSS 0.3%CVE-2022-3261MEDIUMPlain-text passwords saved in /var/log/messagesEPSS 0.3%CVE-2026-23797MEDIUMPlaintext password display in Quick.CartEPSS 0.3%CVE-2026-19051HIGHPlaintext Storage of User Credentials in Menulux Software's Menulux PortalEPSS 0.3%CVE-2026-55164MEDIUMLemur: Plaintext password storage in Lemur user-update pathEPSS 0.3%CVE-2026-63315HIGHPlaintext storage of a password in WebCTIEPSS 0.3%CVE-2025-15128MEDIUMZKTeco BioTime Endpoint safe_setting credentials storageEPSS 0.3%CVE-2025-9982MEDIUMHard-coded admin credentials in Quick.CMSEPSS 0.3%CVE-2022-0555HIGHSubiquity Shows Guided Storage Passphrase in Plaintext with Read-all PermissionsEPSS 0.3%CVE-2025-0936MEDIUMOn affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possiblyEPSS 0.3%CVE-2025-52164HIGHSoftware GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.EPSS 0.3%CVE-2026-57302MEDIUMJenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be vEPSS 0.3%CVE-2025-46809MEDIUMMulti Linux Manager epxoses the plain text HTTP Proxy user:password in logsEPSS 0.3%CVE-2025-53660MEDIUMJenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, incEPSS 0.3%CVE-2026-110975HIGHAutotune: kruize/autotune: kruize/autotune: datasources credential disclosureEPSS 0.3%CVE-2025-45702MEDIUMSoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.EPSS 0.3%CVE-2024-43186MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.3%CVE-2026-103094HIGHCleartext Storage of OAuth Credentials in ServiceNow AI PlatformEPSS 0.3%CVE-2025-53669MEDIUMJenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential fEPSS 0.3%CVE-2025-14183MEDIUMSGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storageEPSS 0.3%