Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2024-21383LOWMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.4%CVE-2026-74901CRITICALopenssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR FallbackEPSS 0.4%CVE-2025-32977CRITICALQuest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 EPSS 0.4%CVE-2023-49646MEDIUMImproper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via networEPSS 0.4%CVE-2024-47832CRITICALXML Signature Bypass via differential XML parsing in ssoreadyEPSS 0.4%CVE-2023-49079CRITICALMisskey's missing signature validation allows arbitrary users to impersonate any remote user.EPSS 0.4%CVE-2021-31847HIGHImproper privilege management in repair process of MA for WindowsEPSS 0.4%CVE-2026-54248MEDIUMDoco-CD has an OCI Trust Policy Bypass via Artifact-Contained ConfigurationEPSS 0.4%CVE-2023-28801CRITICALImproper SAML signature verificationEPSS 0.4%CVE-2023-34205CRITICALIn Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, EPSS 0.4%CVE-2026-80469HIGHCVE-2026-80469EPSS 0.4%CVE-2023-2030LOWImproper Verification of Cryptographic Signature in GitLabEPSS 0.4%CVE-2026-50721HIGHIKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payloadEPSS 0.4%CVE-2026-89042CRITICALpassport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature VerificationEPSS 0.4%CVE-2026-82454CRITICALOmnivore before android-0.227.0 Authentication Bypass via Apple Sign-inEPSS 0.4%CVE-2023-44077CRITICALStudio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636.EPSS 0.4%CVE-2024-54150HIGHAlgorithm Confusion Vulnerability in cjwtEPSS 0.4%CVE-2023-54355HIGHPocketMine-MP 5.2.0 Server Crash via Incorrect EC CurveEPSS 0.4%CVE-2026-112518MEDIUMAn issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27EPSS 0.4%CVE-2025-54419CRITICALNode-SAML Contains SAML Signature Verification VulnerabilityEPSS 0.4%