Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-17301CRITICALMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%CVE-2026-96760CRITICALAuthlib library contains a signature‑verification bypass vulnerabilityEPSS 0.4%CVE-2025-59334CRITICALLinkr allows manifest tampering leading to arbitrary file injectionEPSS 0.4%CVE-2026-48526HIGHPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedEPSS 0.4%CVE-2026-81701CRITICALopenssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned pluginEPSS 0.4%CVE-2026-10579CRITICALPicketlink-federation: auth bypass in picketlink saml unsolicited-responseEPSS 0.4%CVE-2026-54155HIGHnode-opcua: Missing nonce verification in UserNameIdentityToken authenticationEPSS 0.4%CVE-2026-87696HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-27670CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation OEPSS 0.4%CVE-2022-47549MEDIUMAn unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allowEPSS 0.4%CVE-2025-66567CRITICALruby-saml has a SAML authentication bypass due to namespace handling (parser differential)EPSS 0.4%CVE-2025-27773HIGHSimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect bindingEPSS 0.4%CVE-2026-54782CRITICALCoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validationEPSS 0.4%CVE-2026-85818CRITICALWindows Schannel Spoofing VulnerabilityEPSS 0.4%CVE-2025-54982CRITICALSAML 2.0 Public Key Validation IssueEPSS 0.4%CVE-2026-44104CRITICALControllerAgent does not perform validation of firmwareEPSS 0.4%CVE-2024-7479HIGHImproper signature verification of VPN driver installation in TeamViewer Remote ClientsEPSS 0.4%CVE-2022-23334CRITICALThe Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackersEPSS 0.4%CVE-2021-1461MEDIUMCisco SD-WAN Software Signature Verification Bypass VulnerabilityEPSS 0.4%CVE-2002-1796HIGHChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, EPSS 0.4%