Falhas do tipo CWE-256

232 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2022-22554HIGHDell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local attacker with user priEPSS 0.2%CVE-2026-21417HIGHDell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged atEPSS 0.2%CVE-2024-42496LOWSmart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploEPSS 0.2%CVE-2022-29085MEDIUMDell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certaiEPSS 0.2%CVE-2023-44300MEDIUM Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentEPSS 0.2%CVE-2026-31850MEDIUMPlaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+EPSS 0.2%CVE-2025-65009HIGHInsecure Password Storage in WODESYS WD-R608U routerEPSS 0.2%CVE-2024-31899MEDIUMIBM Cognos Command Center information disclosureEPSS 0.2%CVE-2026-41874MEDIUMHard-coded admin credentials in Quick.CartEPSS 0.2%CVE-2025-43005MEDIUMInformation Disclosure vulnerability in SAP GUI for WindowsEPSS 0.2%CVE-2026-82783MEDIUMPlaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical accessEPSS 0.2%CVE-2021-3787MEDIUMA vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MEPSS 0.2%CVE-2022-47561HIGHUnprotected Storage of Credentials in Ormazabal productsEPSS 0.2%CVE-2022-41732MEDIUMIBM Maximo information disclosureEPSS 0.2%CVE-2024-45283MEDIUMInformation disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)EPSS 0.2%CVE-2022-4308MEDIUMClear-text passwords in configuration filesEPSS 0.2%CVE-2024-27166HIGHInsecure permissionsEPSS 0.2%CVE-2025-24375MEDIUMMySQL K8s charm could leak credentials for root-level user `serverconfig`EPSS 0.2%CVE-2023-27315MEDIUMInformation Disclosure Vulnerability in SnapGathers EPSS 0.2%CVE-2025-21102HIGHDell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with lEPSS 0.2%