Weaknesses of type CWE-347

641 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-5430CRITICALAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverEPSS 0.3%CVE-2021-3521—There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not EPSS 0.3%CVE-2026-78223MEDIUMToken revocation record built from unverified JWT claims in AshAuthenticationEPSS 0.3%CVE-2026-46684CRITICALDataEase: Unauthorized Command Execution VulnerabilityEPSS 0.3%CVE-2026-24850MEDIUMML-DSA Signature Verification Accepts Signatures with Repeated Hint IndicesEPSS 0.3%CVE-2026-46354CRITICALCoder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theftEPSS 0.3%CVE-2026-7557CRITICALSAML authentication bypass in Progress MarkLogic ServerEPSS 0.3%CVE-2025-24800CRITICALCritical vulnerability in `ismp-grandpa` <v15.0.1EPSS 0.3%CVE-2020-22659HIGHIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, RuckusEPSS 0.3%CVE-2023-28602LOWZoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may poEPSS 0.3%CVE-2025-7937HIGHSupermicro BMC firmware update validation bypassEPSS 0.3%CVE-2025-6198HIGHSupermicro BMC firmware update validation bypassEPSS 0.3%CVE-2019-12662MEDIUMCisco NX-OS and IOS XE Software Virtual Service Image Signature Bypass VulnerabilityEPSS 0.3%CVE-2025-12006HIGHSupermicro BMC firmware update validation bypassEPSS 0.3%CVE-2025-33069MEDIUMWindows App Control for Business Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2024-42459MEDIUMIn the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zEPSS 0.3%CVE-2024-23480HIGHInsecure MacOS code sign check fallback EPSS 0.3%CVE-2023-52043HIGHAn issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point PasEPSS 0.3%CVE-2026-58426CRITICALGitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeEPSS 0.3%CVE-2026-0750HIGHPayment bypass in Commerce PayboxEPSS 0.3%