Falhas do tipo CWE-259

210 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2023-23770CRITICALMotorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing EPSS 0.5%CVE-2024-38902CRITICALH3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as rooEPSS 0.5%CVE-2024-25825CRITICALFydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the EPSS 0.5%CVE-2024-39345HIGHAdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support EPSS 0.5%CVE-2025-8974MEDIUMlinlinjava litemall JSON Web Token JwtHelper.java hard-coded credentialsEPSS 0.5%CVE-2024-38885HIGHAn issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker tEPSS 0.5%CVE-2024-33625CRITICALCyberPower PowerPanel business Use of Hard-coded PasswordEPSS 0.5%CVE-2024-34539CRITICALHardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. TEPSS 0.5%CVE-2023-37231CRITICALLoftware Spectrum before 4.6 HF14 uses a Hard-coded Password.EPSS 0.5%CVE-2024-2420HIGHLenelS2 NetBox Hardcoded CredentialsEPSS 0.5%CVE-2026-7251CRITICALEppendorf BioFlo 320 Use of hard-coded passwordEPSS 0.5%CVE-2023-50948MEDIUMIBM Storage Fusion HCI information disclosureEPSS 0.5%CVE-2024-2038HIGHVisual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded CredentialsEPSS 0.5%CVE-2021-27254MEDIUMThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is EPSS 0.5%CVE-2020-12037—Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TEPSS 0.5%CVE-2025-59388MEDIUMHyper Data ProtectorEPSS 0.5%CVE-2026-19750CRITICALTenda CH/CP/TX3 SSH hard-coded passwordEPSS 0.5%CVE-2024-37644HIGHTRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackerEPSS 0.5%CVE-2022-29825MEDIUMUse of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) veEPSS 0.5%CVE-2025-44955HIGHRUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.EPSS 0.5%