Falhas do tipo CWE-256

224 resultados

Senha codificada ou armazenamento em texto plano

A fraqueza ocorre quando um desenvolvedor insere uma senha diretamente no código-fonte ou a armazena sem criptografia em arquivos de configuração, logs ou banco de dados. Qualquer pessoa com acesso ao código, binário compilado ou arquivos do sistema consegue ler essa senha e usar para comprometer contas ou sistemas.

Exemplo

Um aplicativo Python que conecta ao banco de dados com `psycopg2.connect(dbname='app', user='admin', password='Senha123')` no próprio código, ou um arquivo config.ini contendo `db_password=MinhaSenh@2024` em texto plano no repositório do projeto.

Como mitigar

Use variáveis de ambiente, arquivos de secrets gerenciados (como HashiCorp Vault, AWS Secrets Manager) ou gerenciadores de credenciais do SO para carregar senhas em tempo de execução. Nunca comite senhas em repositórios Git; sempre aplique criptografia de senhas armazenadas com funções como bcrypt ou Argon2.

CVE-2026-21417HIGHDell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged atEPSS 0.2%CVE-2026-31850MEDIUMPlaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+EPSS 0.2%CVE-2025-43005MEDIUMInformation Disclosure vulnerability in SAP GUI for WindowsEPSS 0.2%CVE-2021-3787MEDIUMA vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MEPSS 0.2%CVE-2022-47561HIGHUnprotected Storage of Credentials in Ormazabal productsEPSS 0.2%CVE-2024-45283MEDIUMInformation disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)EPSS 0.2%CVE-2022-41732MEDIUMIBM Maximo information disclosureEPSS 0.2%CVE-2024-27166HIGHInsecure permissionsEPSS 0.2%CVE-2022-4308MEDIUMClear-text passwords in configuration filesEPSS 0.2%CVE-2025-21102HIGHDell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with lEPSS 0.2%CVE-2025-24375MEDIUMMySQL K8s charm could leak credentials for root-level user `serverconfig`EPSS 0.2%CVE-2024-25052MEDIUMIBM Jazz Reporting Service information disclosureEPSS 0.2%CVE-2025-25727MEDIUMBosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.EPSS 0.2%CVE-2026-50641HIGHPlaintext password storage in Streamsoft Business IntelligenceEPSS 0.2%CVE-2024-21869MEDIUMPlaintext Storage of a Password in Rapid SCADAEPSS 0.2%CVE-2023-27315MEDIUMInformation Disclosure Vulnerability in SnapGathers EPSS 0.2%CVE-2025-2355MEDIUMBlackVue App API Endpoint credentials storageEPSS 0.2%CVE-2025-34210CRITICALVasion Print (formerly PrinterLogic) Readable Cleartext PasswordsEPSS 0.2%CVE-2025-36258HIGHIBM InfoSphere Information Server is vulnerable due to plaintext storage of a passwordEPSS 0.2%CVE-2024-22312MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.2%