Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-58490CRITICALTracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaultsEPSS 0.3%CVE-2019-1812MEDIUMCisco NX-OS CLI Command Software Image Signature Verification VulnerabilitiesEPSS 0.3%CVE-2019-1813MEDIUMCisco NX-OS CLI Command Software Image Signature Verification VulnerabilityEPSS 0.3%CVE-2026-18092HIGHNet::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtreeEPSS 0.3%CVE-2026-24850MEDIUMML-DSA Signature Verification Accepts Signatures with Repeated Hint IndicesEPSS 0.3%CVE-2026-33026CRITICALnginx-ui Backup Restore Allows Tampering with Encrypted BackupsEPSS 0.3%CVE-2026-95633HIGHCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.3%CVE-2026-22097CRITICALMissing firmware validation allows remote code executionEPSS 0.3%CVE-2026-13722HIGHWatchGuard Firebox Firmware Image Validation Bypass in WatchGuard Fireware OSEPSS 0.3%CVE-2025-23206LOWIAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdkEPSS 0.3%CVE-2024-38069HIGHWindows Enroll Engine Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-68759HIGHIntegration credential holders may impersonate users in JFrog AccessEPSS 0.3%CVE-2025-24800CRITICALCritical vulnerability in `ismp-grandpa` <v15.0.1EPSS 0.3%CVE-2024-49393MEDIUMMutt: neomutt: to and cc email header fields are not protected by cryptographic signingEPSS 0.3%CVE-2026-59163CRITICALMnemosyne has JWT signature verification bypass sync server that allows authentication bypassEPSS 0.3%CVE-2026-97799HIGHWindows Audio Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2021-3521—There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not EPSS 0.3%CVE-2024-49394MEDIUMMutt: neomutt: in-reply-to email header field it not protected by cryptograpic signingEPSS 0.3%CVE-2026-107720HIGHfast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setEPSS 0.3%CVE-2025-6198HIGHSupermicro BMC firmware update validation bypassEPSS 0.3%