Falhas do tipo CWE-798

941 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2022-29778HIGHD-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' atEPSS 2.7%CVE-2021-31477MEDIUMThis vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is EPSS 2.6%CVE-2026-56265CRITICALCrawl4AI - Authentication Bypass via Hardcoded JWT Signing KeyEPSS 2.6%CVE-2019-1675HIGHCisco Aironet Active Sensor Static Credentials VulnerabilityEPSS 2.6%CVE-2020-3158CRITICALCisco Smart Software Manager On-Prem Static Default Credential VulnerabilityEPSS 2.6%CVE-2017-14027—A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FXEPSS 2.5%CVE-2019-13657CRITICALCA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote EPSS 2.5%CVE-2024-5471HIGHAgent takeoverEPSS 2.5%CVE-2014-125115CRITICALPandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCEEPSS 2.5%CVE-2021-40390CRITICALAn authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP reqEPSS 2.5%CVE-2023-20101CRITICALA vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root EPSS 2.4%CVE-2022-22722—A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain theEPSS 2.4%CVE-2018-0329—A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application ServiceEPSS 2.4%CVE-2023-44411CRITICALD-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass VulnerabilityEPSS 2.4%CVE-2019-13553—Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected syEPSS 2.3%CVE-2020-3382CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilityEPSS 2.3%CVE-2020-6981—In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.EPSS 2.3%CVE-2022-22056CRITICALLe-yan Co., Ltd. dental management system - Hard-coded CredentialsEPSS 2.3%CVE-2026-19900CRITICALLB-LINK X-PRO shadow hard-coded credentialsEPSS 2.2%CVE-2024-9486CRITICALVM images built with Image Builder and Proxmox provider use default credentialsEPSS 2.2%