Falhas do tipo CWE-798

941 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2026-73519CRITICALWolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-SecretEPSS 0.8%CVE-2016-20026CRITICALZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code ExecutionEPSS 0.8%CVE-2024-41611CRITICALIn D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely tEPSS 0.8%CVE-2024-29063HIGHAzure AI Search Information Disclosure VulnerabilityEPSS 0.8%CVE-2025-35451CRITICALPan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabledEPSS 0.8%CVE-2022-44096CRITICALSanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and accessEPSS 0.8%CVE-2022-44097CRITICALBook Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access tEPSS 0.8%CVE-2026-57147CRITICALpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryEPSS 0.8%CVE-2026-47281CRITICALVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-38337CRITICALWhen aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid loginEPSS 0.8%CVE-2024-10025CRITICALVulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xxEPSS 0.8%CVE-2022-39273MEDIUMDefault OAuth Authorization Server secret in FlyteAdminEPSS 0.8%CVE-2023-35987CRITICALPiiGAB M-Bus Use of Hard-coded CredentialsEPSS 0.8%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2023-1269MEDIUMUse of Hard-coded Credentials in alextselegidis/easyappointmentsEPSS 0.7%CVE-2023-2138CRITICALUse of Hard-coded Credentials in nuxtlabs/github-moduleEPSS 0.7%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2023-39420CRITICALUse of Hard-coded Credentials in RDPCore.dllEPSS 0.7%CVE-2024-23816CRITICALA vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location IntelligenEPSS 0.7%CVE-2019-10995—ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phasEPSS 0.7%