Falhas do tipo CWE-259

210 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2020-12045—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), opEPSS 1.7%CVE-2014-5434—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account withEPSS 1.6%CVE-2020-2499MEDIUMHard-coded Password Vulnerability in QESEPSS 1.4%CVE-2019-13530—Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501,EPSS 1.4%CVE-2021-27440—The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components EPSS 1.4%CVE-2024-8580CRITICALTOTOLINK AC1200 T8 shadow.sample hard-coded passwordEPSS 1.3%CVE-2022-29831HIGHUse of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unautheEPSS 1.3%CVE-2024-26196MEDIUMMicrosoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityEPSS 1.2%CVE-2017-20039CRITICALSICUNET Access Controller hard-coded passwordEPSS 1.2%CVE-2025-6932MEDIUMD-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded passwordEPSS 1.2%CVE-2021-38456CRITICALMoxa MXview Network Management SoftwareEPSS 1.2%CVE-2017-6039—A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded EPSS 1.2%CVE-2026-2616HIGHBeetel 777VR1 Web Management hard-coded credentialsEPSS 1.2%CVE-2025-20286CRITICALISE on AWS Static CredentialEPSS 1.1%CVE-2021-28813CRITICALInsufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitchEPSS 1.1%CVE-2021-34601CRITICALBender Charge Controller: Hardcoded Credentials in Charge ControllerEPSS 1.1%CVE-2021-36312CRITICALDell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowlEPSS 1.1%CVE-2020-5351HIGHDell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with aEPSS 1.1%CVE-2022-30271CRITICALThe Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_servEPSS 1.0%CVE-2022-27172MEDIUMA hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafteEPSS 1.0%