Weaknesses of type CWE-347

641 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-4258HIGHVersions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve vEPSS 0.2%CVE-2026-6873LOWSigned cookie salt namespace collision in django.http.HttpRequest.get_signed_cookieEPSS 0.2%CVE-2019-1728MEDIUMCisco FXOS and NX-OS Software Secure Configuration Bypass VulnerabilityEPSS 0.2%CVE-2026-67276CRITICALSSH user impersonation possible in Mikrotik RouterOSEPSS 0.2%CVE-2026-86109HIGHSecurity Advisory 0182EPSS 0.2%CVE-2023-28804HIGHLinux ZCC allows unsigned updates, allowing elevated Code ExecutionEPSS 0.2%CVE-2026-81700CRITICALopenssl_encrypt before 1.4.9 GPG Signature Verification BypassEPSS 0.2%CVE-2021-31841HIGHDLL side loading vulnerability in MA for WindowsEPSS 0.2%CVE-2026-13089HIGHOIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verifyEPSS 0.2%CVE-2024-37886MEDIUMNextcloud user_oidc's ID4me does not validate signature or expirationEPSS 0.2%CVE-2026-28148CRITICALWordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2026-15556HIGHPicketlink-federation: picketlink saml 2.0 auth bypass via missing assertionsEPSS 0.2%CVE-2025-31335MEDIUMThe OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely EPSS 0.2%CVE-2019-12649MEDIUMCisco IOS XE Software Digital Signature Verification Bypass VulnerabilityEPSS 0.2%CVE-2025-55039MEDIUMApache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksEPSS 0.2%CVE-2018-15374—Cisco IOS XE Software Digital Signature Verification Bypass VulnerabilityEPSS 0.2%CVE-2025-8454CRITICALIt was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scEPSS 0.2%CVE-2026-82454CRITICALOmnivore before android-0.227.0 Authentication Bypass via Apple Sign-inEPSS 0.2%CVE-2025-59288MEDIUMPlaywright Spoofing VulnerabilityEPSS 0.2%CVE-2023-33185MEDIUMIncorrect signature verification in django-sesEPSS 0.2%