Weaknesses of type CWE-347

642 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-52767HIGHYesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`EPSS 0.2%CVE-2025-41767HIGHSignature bypass on update uploadEPSS 0.2%CVE-2025-41669HIGHInsufficient Verification of Data AuthenticityEPSS 0.2%CVE-2026-23992MEDIUMgo-tuf improperly validates the configured threshold for delegationsEPSS 0.2%CVE-2026-23965HIGHsm-crypto Affected by Signature Forgery in SM2-DSAEPSS 0.2%CVE-2026-6986MEDIUMCesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verificationEPSS 0.2%CVE-2026-47304HIGH.NET Security Feature Bypass VulnerabilityEPSS 0.2%CVE-2025-65945HIGHauth0/node-jws improper HMAC signature verification vulnerabilityEPSS 0.2%CVE-2023-39211HIGHImproper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user toEPSS 0.2%CVE-2026-23967HIGHsm-crypto Affected by Signature Malleability in SM2-DSAEPSS 0.2%CVE-2025-57801HIGHgnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checksEPSS 0.2%CVE-2026-6329MEDIUMPKCS#12 MAC verification uses attacker-controlled comparison lengthEPSS 0.2%CVE-2022-20944MEDIUMCisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution VulnerabilityEPSS 0.2%CVE-2023-50228HIGHParallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-32614HIGHGo ShangMi SM9 Infinity-Point Ciphertext Forgery VulnerabilityEPSS 0.2%CVE-2024-23680MEDIUMAWS Encryption SDK for Java Improper Verification of Cryptographic SignatureEPSS 0.2%CVE-2026-75939HIGHOpenshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumedEPSS 0.2%CVE-2026-44699CRITICALLibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMACEPSS 0.2%CVE-2026-54581HIGHmport bootstrap index fetch can continue after hash verification failureEPSS 0.2%CVE-2026-22696CRITICALdcap-qvl has Missing Verification for QE IdentityEPSS 0.2%