Weaknesses of type CWE-347

763 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-3564CRITICALScreenConnect Instance Level Cryptographic Material ExposureEPSS 0.4%CVE-2026-75939HIGHOpenshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumedEPSS 0.4%CVE-2026-102502MEDIUMCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.4%CVE-2025-20178MEDIUMCisco Secure Network Analytics Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-54773MEDIUMCoreWCF: WS-Security signature substitution via document-wide Signature lookupEPSS 0.4%CVE-2026-65616HIGHPotential privilege escalation to JFrog administrator privilegesEPSS 0.4%CVE-2026-13089HIGHOIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verifyEPSS 0.4%CVE-2023-47122MEDIUMGitsign's Rekor public keys fetched from upstream API instead of local TUF client.EPSS 0.4%CVE-2022-39200HIGHSignature checks not applied to some retrieved missing eventsEPSS 0.4%CVE-2026-54330HIGHCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalationEPSS 0.4%CVE-2026-9027MEDIUMCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST EndpointEPSS 0.4%CVE-2024-11696MEDIUMThe application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flawEPSS 0.4%CVE-2026-4600CRITICALVersions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameEPSS 0.4%CVE-2023-53951CRITICALEver Gauzy v0.281.9 JWT Authentication Weakness via HMAC SecretEPSS 0.4%CVE-2026-107722CRITICALfast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionEPSS 0.4%CVE-2023-25574CRITICALJupyterHub's LTI13Authenticator: JWT signature not validatedEPSS 0.4%CVE-2026-111062LOWA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestEPSS 0.4%CVE-2023-33959HIGHVerification bypass can cause users into verifying the wrong artifactEPSS 0.4%CVE-2023-41037MEDIUMCleartext Signed Message Signature Spoofing in openpgpjsEPSS 0.4%CVE-2024-37532HIGHIBM WebSphere Application Server identity spoofingEPSS 0.4%