Falhas do tipo CWE-798

941 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2021-33529HIGHWEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerabilityEPSS 0.9%CVE-2025-10639HIGHUsage of Hardcoded FTP Credentials EfficientLab WorkExaminer ProfessionalEPSS 0.9%CVE-2023-48388CRITICALMultisuns EasyLog web+ - Use of Hard-coded PasswordEPSS 0.9%CVE-2022-28812CRITICALUse of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.EPSS 0.9%CVE-2024-10451MEDIUMOrg.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build processEPSS 0.9%CVE-2021-45033—A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/EPSS 0.9%CVE-2024-2161CRITICALUse of Hard-coded Credentials in Kiloview NDI N series products API middlewareEPSS 0.9%CVE-2023-39169CRITICALSENEC: Storage Box V1,V2 and V3 using default credentialsEPSS 0.9%CVE-2023-26511CRITICALA Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain acEPSS 0.9%CVE-2025-59091CRITICALHardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300EPSS 0.9%CVE-2025-59092HIGHUnauthenticated RPC Service in dormakaba Kaba exos 9300EPSS 0.9%CVE-2016-9495—Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentialsEPSS 0.9%CVE-2023-24155CRITICALTOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-biEPSS 0.9%CVE-2018-10898HIGHA vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuratEPSS 0.9%CVE-2025-27643CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.EPSS 0.9%CVE-2021-33014HIGHKUKA KR C4 - Use of Hard-Coded CredentialsEPSS 0.9%CVE-2025-69425CRITICALRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCEEPSS 0.9%CVE-2025-56157CRITICALDefault credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source coEPSS 0.9%CVE-2022-4333CRITICALSprecher: Sprecon maintenance access with hardcoded credentialsEPSS 0.9%CVE-2024-52295CRITICALDataEase has a forged JWT token vulnerabilityEPSS 0.9%