Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2025-7937HIGHSupermicro BMC firmware update validation bypassEPSS 0.3%CVE-2026-58085HIGHMissing MAC validation in wg(4) packet decryptionEPSS 0.3%CVE-2020-22659HIGHIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, RuckusEPSS 0.3%CVE-2026-33487HIGHgoxmldsig has validateSignature Loop Variable Capture Signature BypassEPSS 0.3%CVE-2026-16443HIGHKeycloak-services: keycloak-services: saml broker metadata import disables response signature validationEPSS 0.3%CVE-2026-69646HIGHSkype for Business Spoofing VulnerabilityEPSS 0.3%CVE-2025-33069MEDIUMWindows App Control for Business Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-46684CRITICALDataEase: Unauthorized Command Execution VulnerabilityEPSS 0.3%CVE-2026-18568HIGHXML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic checkEPSS 0.3%CVE-2026-46354CRITICALCoder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theftEPSS 0.3%CVE-2022-23507MEDIUMLight client verification not taking into account chain IDEPSS 0.3%CVE-2026-82461HIGHpac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access TokenEPSS 0.3%CVE-2026-58200HIGH@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter SigningEPSS 0.3%CVE-2026-0750HIGHPayment bypass in Commerce PayboxEPSS 0.3%CVE-2026-85962HIGHImproper authentication in Progress MarkLogic Server SAML processingEPSS 0.3%CVE-2026-42784HIGHSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusionEPSS 0.3%CVE-2023-28602LOWZoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may poEPSS 0.3%CVE-2026-18108CRITICALNet::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signatureEPSS 0.3%CVE-2026-86304CRITICALMojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchorEPSS 0.3%CVE-2026-89043CRITICALpassport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion PrependingEPSS 0.3%