Falhas do tipo CWE-259

210 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2023-46685CRITICALA hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specEPSS 1.0%CVE-2024-4708CRITICALmySCADA myPRO Use of Hard-coded PasswordEPSS 1.0%CVE-2019-10881CRITICALDefault hidden Privileged Account Vulnerability in multiple XEROX devicesEPSS 1.0%CVE-2022-45444CRITICALCVE-2022-45444EPSS 0.9%CVE-2022-22144HIGHA hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_0EPSS 0.9%CVE-2023-3237MEDIUMOTCMS hard-coded passwordEPSS 0.9%CVE-2023-32145HIGHD-Link DAP-1360 Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.9%CVE-2024-29011HIGHUse of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlieEPSS 0.9%CVE-2025-27638CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.EPSS 0.9%CVE-2024-36526CRITICALZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.EPSS 0.9%CVE-2014-125030MEDIUMtaoeffect Empress hard-coded passwordEPSS 0.9%CVE-2018-25069HIGHNetis Netcore Router hard-coded passwordEPSS 0.9%CVE-2023-2799MEDIUMcnoa OA hard-coded passwordEPSS 0.8%CVE-2025-1100CRITICALA CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatedEPSS 0.8%CVE-2024-41616HIGHD-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.EPSS 0.8%CVE-2024-7170MEDIUMTOTOLINK A3000RU product.ini hard-coded passwordEPSS 0.7%CVE-2021-32521HIGHQSAN Storage Manager, XEVO, SANOS - Use of Hard-coded PasswordEPSS 0.7%CVE-2025-7079MEDIUMmao888 bluebell-plus JWT Token jwt.go hard-coded passwordEPSS 0.7%CVE-2026-1610CRITICALTenda AX12 Pro V2 Telnet Service hard-coded credentialsEPSS 0.7%CVE-2025-2322MEDIUM274056675 springboot-openai-chatgpt OpenController.java hard-coded credentialsEPSS 0.7%