Falhas do tipo CWE-798

943 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2025-57578HIGHAn issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via the default passwordEPSS 0.5%CVE-2026-27167NONEGradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session SecretEPSS 0.5%CVE-2024-36049MEDIUMAptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and pasEPSS 0.5%CVE-2023-6255HIGHHardcoded Credentals in SoliClub Mobile AppEPSS 0.5%CVE-2026-32834HIGHEasy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code ScanningEPSS 0.4%CVE-2023-34284MEDIUMNETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass VulnerabilityEPSS 0.4%CVE-2026-57172HIGHDataEase: Hardcoded JWT Signing Secret in ShareLinkEPSS 0.4%CVE-2024-45656CRITICALIBM Flexible Service Processor hard coded credentialsEPSS 0.4%CVE-2024-54750CRITICALUbiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.EPSS 0.4%CVE-2023-30354CRITICALShenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi passwoEPSS 0.4%CVE-2025-32985CRITICALNETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.EPSS 0.4%CVE-2024-0390MEDIUMHard-coded credentials in iZZi connect applicationEPSS 0.4%CVE-2020-37135CRITICALAMSS++ 4.7 - Backdoor Admin AccountEPSS 0.4%CVE-2024-5810MEDIUMWP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded CredentialsEPSS 0.4%CVE-2026-69102CRITICALMaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trustEPSS 0.4%CVE-2023-33836MEDIUMIBM Security Verify Governance information disclosureEPSS 0.4%CVE-2026-13086CRITICALFireware OS Stack-Based Buffer Overflow in Mobile Security epm EndpointEPSS 0.4%CVE-2026-42869CRITICALSOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC toolsEPSS 0.4%CVE-2025-30113CRITICALAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. TEPSS 0.4%CVE-2025-30123CRITICALAn issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enEPSS 0.4%