Falhas do tipo CWE-798

943 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2025-48491LOWProject AI API Key Exposure in Source CodeEPSS 0.6%CVE-2024-38648CRITICALA hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including uEPSS 0.6%CVE-2023-43583MEDIUMCryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allowEPSS 0.6%CVE-2022-27600MEDIUMQTS, QuTS hero, QuTScloudEPSS 0.6%CVE-2021-27503—Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior tEPSS 0.6%CVE-2024-42637CRITICALH3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.EPSS 0.6%CVE-2024-42638CRITICALH3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as rooEPSS 0.6%CVE-2023-48251HIGHThe vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.EPSS 0.6%CVE-2025-7072CRITICALHardcoded credentials in KAON CG3000T/CG3000CT routersEPSS 0.6%CVE-2025-45784CRITICALD-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive usEPSS 0.6%CVE-2021-47796CRITICALDenver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)EPSS 0.6%CVE-2025-7768CRITICALUse of Hard-coded Credentials in Tigo Energy Cloud Connect AdvancedEPSS 0.6%CVE-2023-49253CRITICALPredefined root passwordEPSS 0.6%CVE-2025-40537HIGHSolarWinds Web Help Desk Hardcoded Credentials VulnerabilityEPSS 0.6%CVE-2025-46273CRITICALPlanet Technology Network Products Use of Hard-coded CredentialsEPSS 0.6%CVE-2025-54455CRITICALUse of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicIEPSS 0.6%CVE-2024-4996CRITICALHardcoded Password in Wapro ERP DesktopEPSS 0.6%CVE-2023-25823MEDIUMGradio contains Use of Hard-coded CredentialsEPSS 0.6%CVE-2023-48374MEDIUMSmartStar Software CWS Web-Base - Use of Hard-coded CredentialsEPSS 0.6%CVE-2025-2538CRITICALBUG-000174336EPSS 0.6%