Falhas do tipo CWE-259

221 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2025-7453MEDIUMsaltbo zpan JSON Web Token token.go NewToken hard-coded passwordEPSS 0.4%CVE-2025-2342MEDIUMIROAD X5 Mobile App API Endpoint hard-coded credentialsEPSS 0.4%CVE-2024-27774HIGHUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded PasswordEPSS 0.4%CVE-2026-35905CRITICALT3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access EPSS 0.4%CVE-2026-96548MEDIUMsfturing hosp_order jdbc.properties hard-coded credentialsEPSS 0.4%CVE-2025-7080MEDIUMDone-0 Jank JWT Token jwt_utils.go hard-coded passwordEPSS 0.4%CVE-2024-1228CRITICALHardcoded password in Eurosoft PrzychodniaEPSS 0.4%CVE-2024-3699CRITICALHardcoded password in drEryk GabinetEPSS 0.4%CVE-2025-14126HIGHTOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentialsEPSS 0.4%CVE-2025-6139LOWTOTOLINK T10 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-58081HIGHUse of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenEPSS 0.4%CVE-2026-25753CRITICALPlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)EPSS 0.4%CVE-2025-2402HIGHHard-coded password for object store of KNIME Business HubEPSS 0.4%CVE-2023-29103MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versiEPSS 0.4%CVE-2025-7577MEDIUMTeledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded passwordEPSS 0.4%CVE-2025-25984MEDIUMAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execEPSS 0.4%CVE-2014-5431—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded passEPSS 0.4%CVE-2026-86150MEDIUMTenda CP3 hostapd hard-coded credentialsEPSS 0.4%CVE-2025-9725LOWCudy LT500E Web shadow hard-coded passwordEPSS 0.4%CVE-2024-31798MEDIUMIdentical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrEPSS 0.4%