Falhas do tipo CWE-798

943 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2019-13559—GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited apEPSS 0.3%CVE-2024-32387MEDIUMAn issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via thEPSS 0.3%CVE-2025-56466HIGHHardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.EPSS 0.3%CVE-2026-79740HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2026-79738HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2024-8893HIGHUse of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to EPSS 0.3%CVE-2025-67809MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accesEPSS 0.3%CVE-2024-46505CRITICALInfoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.EPSS 0.3%CVE-2026-85083HIGHCareCam Pro IP Cameras Use of Hard-coded CredentialsEPSS 0.3%CVE-2023-50974MEDIUMIn Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json fileEPSS 0.3%CVE-2020-37092CRITICALNetis E1+ 1.2.32533 - Backdoor Account (root)EPSS 0.3%CVE-2021-32085HIGHAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report andEPSS 0.3%CVE-2021-32087HIGHAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp accoEPSS 0.3%CVE-2026-90509MEDIUMdromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsEPSS 0.3%CVE-2026-93969MEDIUMaiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentialsEPSS 0.3%CVE-2026-93970MEDIUMaiyiyi121 SxDevOps Settings settings.py hard-coded credentialsEPSS 0.3%CVE-2025-2556MEDIUMAudi UTR Dashcam Video Stream hard-coded credentialsEPSS 0.3%CVE-2025-58269MEDIUMWordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2025-58659MEDIUMWordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2019-1688HIGHCisco Network Assurance Engine CLI Access with Default Password VulnerabilityEPSS 0.3%