Falhas do tipo CWE-259

210 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2026-19901CRITICALLB-LINK X-PRO easycwmp hard-coded credentialsEPSS 0.5%CVE-2024-28066HIGHIn Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).EPSS 0.4%CVE-2024-7216LOWTOTOLINK LR1200 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-70041CRITICALAn issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.EPSS 0.4%CVE-2024-35395HIGHTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attaEPSS 0.4%CVE-2025-30115CRITICALAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSEPSS 0.4%CVE-2024-32210MEDIUMThe LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL coEPSS 0.4%CVE-2024-27774HIGHUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded PasswordEPSS 0.4%CVE-2025-11284MEDIUMZytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded passwordEPSS 0.4%CVE-2025-2342MEDIUMIROAD X5 Mobile App API Endpoint hard-coded credentialsEPSS 0.4%CVE-2026-35905CRITICALT3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access EPSS 0.4%CVE-2024-1228CRITICALHardcoded password in Eurosoft PrzychodniaEPSS 0.4%CVE-2024-3699CRITICALHardcoded password in drEryk GabinetEPSS 0.4%CVE-2025-14126HIGHTOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentialsEPSS 0.4%CVE-2025-6139LOWTOTOLINK T10 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-58081HIGHUse of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenEPSS 0.4%CVE-2023-29103MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versiEPSS 0.4%CVE-2025-25984MEDIUMAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execEPSS 0.4%CVE-2025-7453MEDIUMsaltbo zpan JSON Web Token token.go NewToken hard-coded passwordEPSS 0.4%CVE-2025-2402HIGHHard-coded password for object store of KNIME Business HubEPSS 0.4%