Falhas do tipo CWE-798

945 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2026-1612MEDIUMHard-coded AWS Key in AL-KO Robolinho Update SoftwareEPSS 0.4%CVE-2026-24448CRITICALUse of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access.EPSS 0.4%CVE-2024-5764MEDIUMNexus Repository 3 - Static hard-coded encryption passphrase used by defaultEPSS 0.4%CVE-2026-16141HIGHOpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge ValueEPSS 0.4%CVE-2019-25470HIGHeWON Firmware 12.2-13.0 Authentication Bypass via wsdReadFormEPSS 0.4%CVE-2024-38281HIGHUse of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)EPSS 0.4%CVE-2025-10560CRITICALHardcoded cloud credentials in Worksnaps client application binaries expose production cloud resourcesEPSS 0.4%CVE-2024-37630HIGHD-Link DIR-605L v2.13B01 was discovered to contain a hardcoded password vulnerability in /etc/passwd, which allows attackers to log in as roEPSS 0.4%CVE-2026-18164HIGHFlow Neuroscience FL-100 Use of Hard-coded CredentialsEPSS 0.4%CVE-2024-8450HIGHPLANET Technology switch devices - Hard-coded SNMPv1 read-write community stringEPSS 0.4%CVE-2023-40236MEDIUMIn Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authenticatEPSS 0.4%CVE-2025-41710MEDIUMUse of Hard-coded Credentials in power analyzerEPSS 0.4%CVE-2023-4204MEDIUMNPort IAW5000A-I/O Series Hardcoded Credential VulnerabilityEPSS 0.4%CVE-2024-22813MEDIUMAn issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memoEPSS 0.4%CVE-2026-48244MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.phpEPSS 0.4%CVE-2026-48243MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.phpEPSS 0.4%CVE-2026-48245MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.phpEPSS 0.4%CVE-2025-27488MEDIUMMicrosoft Windows Hardware Lab Kit (HLK) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-13463HIGHDue to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []EPSS 0.4%CVE-2026-13446CRITICALLangflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpointsEPSS 0.4%