Falhas do tipo CWE-259

221 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2018-8870MEDIUMMedtronic MyCareLink Patient Monitor Use of Hard-coded PasswordEPSS 0.4%CVE-2025-25428HIGHTRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in aEPSS 0.4%CVE-2026-108584MEDIUMFunnyWolf Viper config hard-coded credentialsEPSS 0.4%CVE-2020-12012—Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,EPSS 0.4%CVE-2025-13252MEDIUMshsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentialsEPSS 0.4%CVE-2025-2343HIGHIROAD Dash Cam X5/Dash Cam X6 Device Pairing hard-coded credentialsEPSS 0.4%CVE-2024-3700CRITICALHardcoded password in Estomed Sp. z o.o. Simple Care softwareEPSS 0.4%CVE-2025-47748MEDIUMNetwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.EPSS 0.4%CVE-2020-7590—A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers EPSS 0.4%CVE-2020-12039—Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 357EPSS 0.3%CVE-2026-105141MEDIUMtopoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentialsEPSS 0.3%CVE-2026-6578MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2024-21990MEDIUMDefault Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utilityEPSS 0.3%CVE-2026-4475HIGHYi Technology YI Home Camera ipc hard-coded credentialsEPSS 0.3%CVE-2023-28895LOWHard-coded password for access to power controller chip memoryEPSS 0.3%CVE-2025-12676MEDIUMKiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization BypassEPSS 0.3%CVE-2023-49963HIGHDYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control.EPSS 0.3%CVE-2026-110667MEDIUMcemtan sar2html sar2html.py hard-coded credentialsEPSS 0.3%CVE-2025-28031MEDIUMTOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini.EPSS 0.3%CVE-2025-46067HIGHAn issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js fileEPSS 0.3%