Falhas do tipo CWE-259

224 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2024-7170MEDIUMTOTOLINK A3000RU product.ini hard-coded passwordEPSS 0.7%CVE-2022-41653CRITICALDaikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials andEPSS 0.7%CVE-2026-1610CRITICALTenda AX12 Pro V2 Telnet Service hard-coded credentialsEPSS 0.7%CVE-2021-32521HIGHQSAN Storage Manager, XEVO, SANOS - Use of Hard-coded PasswordEPSS 0.7%CVE-2025-2322MEDIUM274056675 springboot-openai-chatgpt OpenController.java hard-coded credentialsEPSS 0.7%CVE-2023-41713—SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.EPSS 0.7%CVE-2023-41030MEDIUMJuplink RX4-1500 Hard-coded Credential VulnerabilityEPSS 0.7%CVE-2024-43423CRITICALDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded PasswordEPSS 0.7%CVE-2024-11630MEDIUME-Lins H685/H685f/H700/H720/H750/H820/H820Q/H820Q0/H900 OEM Backend hard-coded credentialsEPSS 0.6%CVE-2024-11026MEDIUMIntelligent Apps Freenow App Keystore SSL.java hard-coded passwordEPSS 0.6%CVE-2024-27488CRITICALIncorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain senEPSS 0.6%CVE-2024-32741CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is usedEPSS 0.6%CVE-2025-11126CRITICALApeman ID71 system.ini hard-coded credentialsEPSS 0.6%CVE-2024-31810CRITICALTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.EPSS 0.6%CVE-2025-9310MEDIUMyeqifu carRental Druid login.html hard-coded credentialsEPSS 0.6%CVE-2026-71809HIGHAuthentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticateEPSS 0.6%CVE-2025-8974MEDIUMlinlinjava litemall JSON Web Token JwtHelper.java hard-coded credentialsEPSS 0.6%CVE-2024-28010CRITICALUse of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, WEPSS 0.6%CVE-2025-15111CRITICALKsenia Security lares Home Automation 1.6 Default Credentials VulnerabilityEPSS 0.6%CVE-2026-23933HIGHHardcoded session key in Zabbix 7.4EPSS 0.6%