Falhas do tipo CWE-798

943 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2019-1688HIGHCisco Network Assurance Engine CLI Access with Default Password VulnerabilityEPSS 0.3%CVE-2025-1029HIGHHardcoded Credentials in Utarit Informatics' SoliClubEPSS 0.3%CVE-2026-86276MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentialsEPSS 0.3%CVE-2026-78062MEDIUMvas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentialsEPSS 0.3%CVE-2026-7579MEDIUMAstrBotDevs AstrBot Dashboard auth.py hard-coded credentialsEPSS 0.3%CVE-2026-28255HIGHUse of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.3%CVE-2026-33893HIGHA vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), TeamcenteEPSS 0.3%CVE-2025-5379MEDIUMNuCom NC-WR744G Console Application hard-coded credentialsEPSS 0.3%CVE-2022-36222HIGHNokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account caEPSS 0.3%CVE-2026-75940CRITICALA vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attackEPSS 0.3%CVE-2025-46617HIGHQuantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software coEPSS 0.3%CVE-2019-25322CRITICALHeatmiser Netmonitor 3.03 - Hardcoded CredentialsEPSS 0.3%CVE-2025-36087HIGHIBM Security Verify Access hard coded credentialsEPSS 0.3%CVE-2024-27168HIGHHardcoded keys used to generate authentication cookiesEPSS 0.3%CVE-2024-45832LOWOssur Mobile Logic Application Use of Hard-coded CredentialsEPSS 0.3%CVE-2026-74891HIGHopenssl_encrypt before 1.4.0 Hardcoded Database CredentialsEPSS 0.3%CVE-2026-23781CRITICALAn issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext withinEPSS 0.3%CVE-2026-6574MEDIUMosuuu LightPicture API Upload Endpoint lp.sql hard-coded credentialsEPSS 0.3%CVE-2025-11643MEDIUMTomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo_img hard-coded credentialsEPSS 0.3%CVE-2026-65879CRITICALJoomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1EPSS 0.3%