Falhas do tipo CWE-259

224 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2025-70802HIGHTenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows aEPSS 0.2%CVE-2026-65117MEDIUMNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successfulEPSS 0.2%CVE-2023-23771HIGHMotorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for servicEPSS 0.2%CVE-2025-2555LOWAudi Universal Traffic Recorder App FTP Credentials hard-coded passwordEPSS 0.2%CVE-2024-48831HIGHDell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability. An unauthenticated attacker withEPSS 0.2%CVE-2024-28023MEDIUMA vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintEPSS 0.2%CVE-2025-9806LOWTenda F1202 Administrative shadow hard-coded credentialsEPSS 0.2%CVE-2025-11666HIGHTenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordEPSS 0.2%CVE-2025-7741LOWHardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used EPSS 0.2%CVE-2025-9380HIGHFNKvision Y215 CCTV Camera Firmware passwd hard-coded credentialsEPSS 0.2%CVE-2025-36609LOWDell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. A low privileged attacker wEPSS 0.2%CVE-2025-9731LOWTenda AC9 Administrative shadow hard-coded credentialsEPSS 0.2%CVE-2025-11649HIGHTomofun Furbo 360/Furbo Mini Root Account hard-coded passwordEPSS 0.1%CVE-2025-9778LOWTenda W12 Administrative shadow hard-coded credentialsEPSS 0.1%CVE-2026-4993MEDIUMwandb OpenUI config.py hard-coded credentialsEPSS 0.1%CVE-2025-3920HIGHHard-coded Password in SUR-FBD CMMSEPSS 0.1%CVE-2025-15371HIGHTenda i24 Shadow File hard-coded credentialsEPSS 0.1%CVE-2025-57175MEDIUMSiklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.EPSS 0.1%CVE-2024-5275HIGHHard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier)EPSS 0.1%CVE-2026-4219MEDIUMINDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentialsEPSS 0.1%