Falhas do tipo CWE-798

941 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2024-6912CRITICALHardcoded MSSQL CredentialsEPSS 1.1%CVE-2019-5622—Accellion File Transfer Appliance Use of Hard-coded CredentialsEPSS 1.1%CVE-2019-11898CRITICALUnauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontiEPSS 1.1%CVE-2021-28813CRITICALInsufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitchEPSS 1.1%CVE-2023-47213CRITICALFirst Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configurationEPSS 1.1%CVE-2023-26089CRITICALEuropean Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. ThEPSS 1.1%CVE-2021-30165HIGHEDIMAX Technology Co., Ltd. HD Wireless Day & Night Network Camera IC-3140W - Hard-coded passwordEPSS 1.1%CVE-2024-23473HIGHSolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability EPSS 1.1%CVE-2022-22813—A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active contrEPSS 1.1%CVE-2024-36248CRITICALAPI keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versioEPSS 1.1%CVE-2024-35244CRITICALThere are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by EPSS 1.1%CVE-2022-21669CRITICALBot token exposed in main.pyEPSS 1.0%CVE-2021-0248CRITICALNFX Series: Hard-coded credentials allow an attacker to take control of any instance through administrative interfaces.EPSS 1.0%CVE-2025-37103CRITICALHardcoded Credential Exposure Allows Unauthorized Access in Web InterfaceEPSS 1.0%CVE-2021-34565CRITICALIn WirelessHART-Gateway versions 3.0.7 to 3.0.9 hard-coded credentials have been foundEPSS 1.0%CVE-2024-24681CRITICALAn issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2).EPSS 1.0%CVE-2022-47618CRITICALMerit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded CredentialsEPSS 1.0%CVE-2022-36159HIGHContec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. AsEPSS 1.0%CVE-2023-37286CRITICALSmartBPM.NET - Use of Hard-Coded Credentials - 1EPSS 1.0%CVE-2022-23402—The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 aEPSS 1.0%