Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-56207CRITICALApache Impala: SAML authentication bypass via forged bearer tokenEPSS 0.5%CVE-2016-20021CRITICALIn Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file bEPSS 0.5%CVE-2025-68113MEDIUMALTCHA Proof-of-Work Vulnerable to Challenge Splicing and ReplayEPSS 0.5%CVE-2023-23773HIGHMotorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation foEPSS 0.5%CVE-2023-23772HIGHMotorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature vEPSS 0.5%CVE-2026-7557CRITICALSAML authentication bypass in Progress MarkLogic ServerEPSS 0.5%CVE-2026-55735HIGHGuardian.revoke/3 acts on unverified token claims, allowing forged-token session revocationEPSS 0.5%CVE-2024-8531HIGHCWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when anEPSS 0.5%CVE-2023-23928MEDIUMreason-jose ignores signature checksEPSS 0.5%CVE-2026-95632HIGHCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.5%CVE-2026-103297HIGHCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.5%CVE-2026-103296HIGHCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.5%CVE-2023-28228MEDIUMWindows Spoofing VulnerabilityEPSS 0.5%CVE-2026-72889CRITICALNet::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verifyEPSS 0.4%CVE-2025-12295HIGHD-Link DAP-2695 Firmware Update sub_40C6B8 signature verificationEPSS 0.4%CVE-2025-64787LOWAcrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.4%CVE-2026-78223MEDIUMToken revocation record built from unverified JWT claims in AshAuthenticationEPSS 0.4%CVE-2023-3347MEDIUMSamba: smb2 packet signing is not enforced when "server signing = required" is setEPSS 0.4%CVE-2025-64786LOWAcrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.4%CVE-2026-17301CRITICALMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%