Falhas do tipo CWE-522

691 resultados

Credenciais Insuficientemente Protegidas

Credenciais (senhas, tokens, chaves de API) armazenadas ou transmitidas sem proteção adequada, deixando-as expostas a interceptação ou acesso não autorizado. O código falha em aplicar criptografia, hash ou controles de acesso, tornando fácil para um atacante roubar ou ler essas informações sensíveis.

Exemplo

Uma aplicação web armazena senhas em banco de dados em texto plano, ou transmite tokens de autenticação via HTTP desprotegido. Um atacante que ganhe acesso ao banco ou intercepte a rede obtém acesso imediato a todas as contas.

Como mitigar

Hash de senhas com algoritmos fortes (bcrypt, Argon2); criptografe dados sensíveis em repouso; use HTTPS obrigatório para transmissão; implemente versionamento e rotação de credenciais; evite armazenar secrets em código-fonte ou variáveis de ambiente sem proteção; use gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager).

CVE-2026-72857HIGHBudibase before 3.40.0 Credential Exposure via STRING FieldsEPSS 0.3%CVE-2026-16104MEDIUMKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminsEPSS 0.3%CVE-2025-62327MEDIUMHCL DevOps Deploy is susceptible to insufficiently protected credentialsEPSS 0.3%CVE-2024-24595MEDIUMAllegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaEPSS 0.3%CVE-2026-49379MEDIUMIn JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesEPSS 0.3%CVE-2025-12636HIGHUbia UboxEPSS 0.3%CVE-2026-12984HIGHExposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601EPSS 0.3%CVE-2026-16553MEDIUMInsufficiently Protected Credentials in GitLabEPSS 0.3%CVE-2021-34700MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-85720MEDIUMAsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT requestEPSS 0.3%CVE-2026-49949MEDIUMCodexBar < 0.33.0 Credential Leakage via HTTP RedirectEPSS 0.3%CVE-2026-29872HIGHA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab82EPSS 0.3%CVE-2026-48976HIGHHomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook HijackEPSS 0.3%CVE-2026-46440HIGHFlowise: Basic Auth Credentials Exposed via APIEPSS 0.3%CVE-2021-33107MEDIUMInsufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and InEPSS 0.3%CVE-2026-72794CRITICALsiyuan before v3.7.4 Session Cookie Key Disclosure via getConfEPSS 0.2%CVE-2020-7306MEDIUMDLP for Mac - Unprotected Storage of CredentialsEPSS 0.2%CVE-2025-54467MEDIUMNeuVector process with sensitive arguments lead to leakageEPSS 0.2%CVE-2021-3681—A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explEPSS 0.2%CVE-2026-7017HIGHHTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targetsEPSS 0.2%