Falhas do tipo CWE-798

941 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2025-46352CRITICALConsilium Safety CS5000 Fire Panel Use of Hard-coded CredentialsEPSS 0.7%CVE-2021-33540HIGHPhoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devicesEPSS 0.7%CVE-2024-8005MEDIUMdemozx gf_cms JWT Authentication auth.go init hard-coded credentialsEPSS 0.7%CVE-2024-1039CRITICALUse of Hard-coded Credentials in Gessler GmbH WEB-MASTEREPSS 0.7%CVE-2021-33531HIGHWEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerabilityEPSS 0.7%CVE-2025-26410CRITICALWeak Hard-coded CredentialsEPSS 0.7%CVE-2024-31151HIGHA security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during theEPSS 0.7%CVE-2023-26566HIGHSangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackeEPSS 0.7%CVE-2023-40300CRITICALNETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.EPSS 0.7%CVE-2025-34209CRITICALVasion Print (formerly PrinterLogic) Hardcoded GPG Private KeyEPSS 0.7%CVE-2024-32740CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentialEPSS 0.7%CVE-2026-1610CRITICALTenda AX12 Pro V2 Telnet Service hard-coded credentialsEPSS 0.7%CVE-2025-2322MEDIUM274056675 springboot-openai-chatgpt OpenController.java hard-coded credentialsEPSS 0.7%CVE-2024-36496HIGHHardcoded CredentialsEPSS 0.7%CVE-2025-42890CRITICALInsecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)EPSS 0.7%CVE-2024-28875HIGHA security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during theEPSS 0.7%CVE-2019-3907—Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash ofEPSS 0.7%CVE-2026-37270CRITICALTrueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and theEPSS 0.7%CVE-2025-13957HIGHCWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS ProEPSS 0.7%CVE-2024-33329HIGHA hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other seEPSS 0.7%