Falhas do tipo CWE-522

689 resultados

Credenciais Insuficientemente Protegidas

Credenciais (senhas, tokens, chaves de API) armazenadas ou transmitidas sem proteção adequada, deixando-as expostas a interceptação ou acesso não autorizado. O código falha em aplicar criptografia, hash ou controles de acesso, tornando fácil para um atacante roubar ou ler essas informações sensíveis.

Exemplo

Uma aplicação web armazena senhas em banco de dados em texto plano, ou transmite tokens de autenticação via HTTP desprotegido. Um atacante que ganhe acesso ao banco ou intercepte a rede obtém acesso imediato a todas as contas.

Como mitigar

Hash de senhas com algoritmos fortes (bcrypt, Argon2); criptografe dados sensíveis em repouso; use HTTPS obrigatório para transmissão; implemente versionamento e rotação de credenciais; evite armazenar secrets em código-fonte ou variáveis de ambiente sem proteção; use gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager).

CVE-2026-62213MEDIUMOpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound RequestsEPSS 0.4%CVE-2026-62208MEDIUMOpenClaw < 2026.6.5 Authorization Header Forwarding via SSEEPSS 0.4%CVE-2026-78555CRITICALRansomLook API Key Disclosure Through /admin/apikeys HTML SourceEPSS 0.4%CVE-2019-3782MEDIUMCredHub CLI writes environment variable credentials to diskEPSS 0.4%CVE-2026-42295HIGHArgo Workflows: Exposure of artifact repository credentialsEPSS 0.4%CVE-2026-35185HIGHHAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addressesEPSS 0.4%CVE-2024-47162MEDIUMIn JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageEPSS 0.4%CVE-2026-71862HIGHCheckmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is EnabledEPSS 0.4%CVE-2025-58366CRITICALOnyxia private helm repository credentials are leaked through unauthenticated APIEPSS 0.4%CVE-2026-92882LOWRedact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responsesEPSS 0.4%CVE-2026-24845MEDIUMmalcontent's OCI image scanning could expose registry credentialsEPSS 0.4%CVE-2026-75960HIGHInsufficiently Protected Credentials in Rently Smart HomeEPSS 0.4%CVE-2023-27126MEDIUMThe AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An atEPSS 0.4%CVE-2025-65098HIGHTypebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization BypassEPSS 0.3%CVE-2025-67732HIGHDify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration EndpointEPSS 0.3%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.3%CVE-2026-76859HIGHNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgiEPSS 0.3%CVE-2026-76857HIGHNetcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgiEPSS 0.3%CVE-2025-52095CRITICALAn issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dllEPSS 0.3%CVE-2026-53454MEDIUMBlueprint Studio stored Git credentials in plaintext Git credential storeEPSS 0.3%