Falhas do tipo CWE-798

945 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2024-32387MEDIUMAn issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via thEPSS 0.3%CVE-2026-81640HIGHSoftish C6 Ear Camera and EarVision Android Application Use of Hard-coded CredentialsEPSS 0.3%CVE-2019-13559—GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited apEPSS 0.3%CVE-2025-56466HIGHHardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.EPSS 0.3%CVE-2024-8893HIGHUse of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to EPSS 0.3%CVE-2025-67809MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accesEPSS 0.3%CVE-2026-85083HIGHCareCam Pro IP Cameras Use of Hard-coded CredentialsEPSS 0.3%CVE-2024-46505CRITICALInfoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.EPSS 0.3%CVE-2020-37092CRITICALNetis E1+ 1.2.32533 - Backdoor Account (root)EPSS 0.3%CVE-2023-50974MEDIUMIn Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json fileEPSS 0.3%CVE-2025-2556MEDIUMAudi UTR Dashcam Video Stream hard-coded credentialsEPSS 0.3%CVE-2019-1688HIGHCisco Network Assurance Engine CLI Access with Default Password VulnerabilityEPSS 0.3%CVE-2025-58656MEDIUMWordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2025-58659MEDIUMWordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-58269MEDIUMWordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2025-1029HIGHHardcoded Credentials in Utarit Informatics' SoliClubEPSS 0.3%CVE-2025-5379MEDIUMNuCom NC-WR744G Console Application hard-coded credentialsEPSS 0.3%CVE-2025-46617HIGHQuantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software coEPSS 0.3%CVE-2022-36222HIGHNokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account caEPSS 0.3%CVE-2019-25322CRITICALHeatmiser Netmonitor 3.03 - Hardcoded CredentialsEPSS 0.3%