Falhas do tipo CWE-259

210 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2025-47823LOWFlock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.EPSS 0.2%CVE-2026-86150MEDIUMTenda CP3 hostapd hard-coded credentialsEPSS 0.2%CVE-2024-33867MEDIUMAn issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.EPSS 0.2%CVE-2024-20412CRITICALA vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthEPSS 0.2%CVE-2023-1944HIGH[minikube] ssh server with default passwordEPSS 0.2%CVE-2025-9309LOWTenda AC10 MD5 Hash shadow hard-coded credentialsEPSS 0.2%CVE-2025-47821LOWFlock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.EPSS 0.2%CVE-2026-23933HIGHHardcoded session key in Zabbix 7.4EPSS 0.2%CVE-2023-23771HIGHMotorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for servicEPSS 0.2%CVE-2025-2555LOWAudi Universal Traffic Recorder App FTP Credentials hard-coded passwordEPSS 0.2%CVE-2025-70802HIGHTenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows aEPSS 0.2%CVE-2025-70798HIGHTenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attaEPSS 0.2%CVE-2024-28023MEDIUMA vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintEPSS 0.2%CVE-2025-7741LOWHardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used EPSS 0.2%CVE-2024-48831HIGHDell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability. An unauthenticated attacker withEPSS 0.2%CVE-2025-11666HIGHTenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordEPSS 0.2%CVE-2025-9806LOWTenda F1202 Administrative shadow hard-coded credentialsEPSS 0.2%CVE-2025-9380HIGHFNKvision Y215 CCTV Camera Firmware passwd hard-coded credentialsEPSS 0.1%CVE-2025-11649HIGHTomofun Furbo 360/Furbo Mini Root Account hard-coded passwordEPSS 0.1%CVE-2025-9731LOWTenda AC9 Administrative shadow hard-coded credentialsEPSS 0.1%