Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2024-37532HIGHIBM WebSphere Application Server identity spoofingEPSS 0.4%CVE-2022-3864MEDIUM A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After rEPSS 0.4%CVE-2026-38651HIGHAuthentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validEPSS 0.4%CVE-2026-52767HIGHYesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`EPSS 0.4%CVE-2026-53501HIGHThumbor has HMAC validation bypass via multiple .replace() calls when removing URL signatureEPSS 0.4%CVE-2020-8324MEDIUMA vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could EPSS 0.4%CVE-2026-81700CRITICALopenssl_encrypt before 1.4.9 GPG Signature Verification BypassEPSS 0.4%CVE-2024-26194HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-74876CRITICALopenssl_encrypt before 1.4.0 Unverified Key Bundle EncryptionEPSS 0.3%CVE-2026-62757MEDIUMWindows Schannel Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2024-52958CRITICALiota C.ai Conversational Platform - Improper Verification of Cryptographic SignatureEPSS 0.3%CVE-2024-50347MEDIUMLaravel Reverb has Missing API Signature VerificationEPSS 0.3%CVE-2026-50722HIGHIKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payloadEPSS 0.3%CVE-2021-43716CRITICALVerification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by enEPSS 0.3%CVE-2026-28148CRITICALWordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2026-18397CRITICALSConnect: Native Host Unauthenticated Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-17379HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.3%CVE-2026-116790CRITICALFreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITYEPSS 0.3%CVE-2026-28198CRITICALPrivilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS ShellEPSS 0.3%CVE-2026-87004HIGHTugtainer: OIDC id_token claims accepted without signature/audience/expiry verificationEPSS 0.3%