Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-76234HIGHlibcrux before 0.0.6 Cryptographic Implementation Bug FixesEPSS 0.3%CVE-2019-12662MEDIUMCisco NX-OS and IOS XE Software Virtual Service Image Signature Bypass VulnerabilityEPSS 0.3%CVE-2026-33746CRITICALConvoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary UsersEPSS 0.3%CVE-2026-91187CRITICALImproper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategyEPSS 0.3%CVE-2026-105869CRITICALApache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleEPSS 0.3%CVE-2026-77105HIGHCommServe Privilege EscalationEPSS 0.3%CVE-2026-73784HIGHHPE IceWall products, Remote Bypass of Security RestrictionsEPSS 0.3%CVE-2024-42459MEDIUMIn the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zEPSS 0.3%CVE-2026-15556HIGHPicketlink-federation: picketlink saml 2.0 auth bypass via missing assertionsEPSS 0.3%CVE-2023-52043HIGHAn issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point PasEPSS 0.3%CVE-2024-23480HIGHInsecure MacOS code sign check fallback EPSS 0.3%CVE-2025-12006HIGHSupermicro BMC firmware update validation bypassEPSS 0.3%CVE-2026-11800HIGHOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusionEPSS 0.3%CVE-2021-22573HIGHIncorrect signature verification on Google-oauth-java-clientEPSS 0.3%CVE-2026-32597HIGHPyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)EPSS 0.3%CVE-2026-56864HIGHIgnore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdbEPSS 0.3%CVE-2026-91898HIGHDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerabilityEPSS 0.3%CVE-2026-88078MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.3%CVE-2026-3562MEDIUMPhilips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass VulnerabilityEPSS 0.3%CVE-2026-4478CRITICALYi Technology YI Home Camera HTTP Firmware Update ipc signature verificationEPSS 0.3%