Falhas do tipo CWE-522

689 resultados

Credenciais Insuficientemente Protegidas

Credenciais (senhas, tokens, chaves de API) armazenadas ou transmitidas sem proteção adequada, deixando-as expostas a interceptação ou acesso não autorizado. O código falha em aplicar criptografia, hash ou controles de acesso, tornando fácil para um atacante roubar ou ler essas informações sensíveis.

Exemplo

Uma aplicação web armazena senhas em banco de dados em texto plano, ou transmite tokens de autenticação via HTTP desprotegido. Um atacante que ganhe acesso ao banco ou intercepte a rede obtém acesso imediato a todas as contas.

Como mitigar

Hash de senhas com algoritmos fortes (bcrypt, Argon2); criptografe dados sensíveis em repouso; use HTTPS obrigatório para transmissão; implemente versionamento e rotação de credenciais; evite armazenar secrets em código-fonte ou variáveis de ambiente sem proteção; use gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager).

CVE-2026-76854HIGHNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgiEPSS 0.5%CVE-2025-54428CRITICALRevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)EPSS 0.5%CVE-2022-46155HIGHAirtable.js credentials exposed in browser buildsEPSS 0.5%CVE-2025-27231MEDIUMLDAP 'Bind password' field value can be leaked by a Zabbix Super AdminEPSS 0.5%CVE-2025-34139HIGHSitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File ReadEPSS 0.5%CVE-2023-23463MEDIUM Sunell DVR – Insufficiently Protected CredentialsEPSS 0.5%CVE-2025-54876MEDIUMJans CLI stores plaintext passwords in the local cli_cmd.log fileEPSS 0.5%CVE-2026-56783HIGHParseable < 2.9.2 - Cleartext Credential Exposure in Notification Target APIEPSS 0.5%CVE-2023-48010CRITICALSTMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as Supervisor on the SEPSS 0.5%CVE-2022-27560MEDIUMAn insufficiently protected credential vulnerability affects HCL VersionVault ExpressEPSS 0.5%CVE-2026-3783MEDIUMtoken leak with redirect and netrcEPSS 0.5%CVE-2026-27167NONEGradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session SecretEPSS 0.5%CVE-2025-2772MEDIUMBEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure VulnerabilityEPSS 0.5%CVE-2020-36968HIGHM/Monit 3.7.4 - Password DisclosureEPSS 0.4%CVE-2026-8926CRITICALpassword leak with netrc and user in URLEPSS 0.4%CVE-2026-11827MEDIUMInsufficiently Protected Credentials in GitLabEPSS 0.4%CVE-2023-43905HIGHIncorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.EPSS 0.4%CVE-2024-38505MEDIUMIn JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteEPSS 0.4%CVE-2022-27544MEDIUMHCL BigFix Web Reports authorized users may see sensitive information in clear textEPSS 0.4%CVE-2026-44938HIGHFleet has PSS Bypass through addLabelsFromOptions in Fleet AgentEPSS 0.4%