Falhas do tipo CWE-798

941 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2023-37608HIGHAn issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there isEPSS 0.9%CVE-2025-35452CRITICALPan-Tilt-Zoom cameras default administrative credentials for web interfaceEPSS 0.9%CVE-2024-41610CRITICALD-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotelyEPSS 0.9%CVE-2026-28778HIGHHardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100EPSS 0.8%CVE-2023-38024CRITICALSpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1EPSS 0.8%CVE-2022-20844MEDIUMCisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password VulnerabilityEPSS 0.8%CVE-2024-28194CRITICALAuthentication Bypass Because of Hardcoded JWT Secret in your_spotifyEPSS 0.8%CVE-2023-38026CRITICALSpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2EPSS 0.8%CVE-2023-24149CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.EPSS 0.8%CVE-2022-42980CRITICALgo-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.EPSS 0.8%CVE-2025-3621CRITICALRemote Code Execution in ProTNS ActADUREPSS 0.8%CVE-2023-28937HIGHDataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunEPSS 0.8%CVE-2023-2291HIGHStatic credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager ProEPSS 0.8%CVE-2023-38995CRITICALAn issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.EPSS 0.8%CVE-2022-39989CRITICALAn issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrEPSS 0.8%CVE-2024-45275CRITICALMB connect line/Helmholz: Hardcoded user accounts with hard-coded passwordsEPSS 0.8%CVE-2013-10002MEDIUMTelecommunication Software SAMwin Contact Center Suite Credential SAMwinLIBVB.dll getCurrentDBVersion hard-coded credentialsEPSS 0.8%CVE-2025-34198CRITICALVasion Print (formerly PrinterLogic) Shared / Hardcoded SSH Host Private Keys in Appliance ImageEPSS 0.8%CVE-2024-23958MEDIUMAutel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.8%CVE-2020-3301HIGHCisco Firepower Management Center Static Credential VulnerabilitiesEPSS 0.8%