Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2025-43023MEDIUMHP Linux Imaging and Printing Software - Use of DSA KeyEPSS 0.3%CVE-2025-24015HIGHDeno's AES GCM authentication tags are not verifiedEPSS 0.3%CVE-2021-43074MEDIUMAn improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versionsEPSS 0.3%CVE-2026-47304HIGH.NET Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-113620CRITICALEclipse ioFog operator WebSocket accepts an unverified JWTEPSS 0.3%CVE-2026-19910HIGHPAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-28804HIGHLinux ZCC allows unsigned updates, allowing elevated Code ExecutionEPSS 0.3%CVE-2026-6966HIGHSignature Threshold Bypass in awslabs/tough Delegated RolesEPSS 0.3%CVE-2026-107724HIGHfast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgeryEPSS 0.3%CVE-2026-10141CRITICALA Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421EPSS 0.3%CVE-2025-29915HIGHSuricata af-packet: defrag option can lead to truncated packets affecting visibilityEPSS 0.3%CVE-2026-46713CRITICALMisskey: JSON-LD signature validation + compaction may lead to improper activity handlingEPSS 0.3%CVE-2020-3209MEDIUMCisco IOS XE Software Digital Signature Verification Bypass VulnerabilityEPSS 0.3%CVE-2026-9487CRITICALXML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate IDEPSS 0.3%CVE-2026-50634MEDIUMApache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entryEPSS 0.3%CVE-2026-87802CRITICALApache Syncope: SRA OAuth2 JWT signature verification bypassEPSS 0.3%CVE-2026-89086CRITICALIn the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proEPSS 0.3%CVE-2026-80465HIGHA vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All vEPSS 0.3%CVE-2025-8454CRITICALIt was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scEPSS 0.3%CVE-2022-31123MEDIUMGrafana plugin signature bypass vulnerabilityEPSS 0.3%