Weaknesses of type CWE-347

642 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-53501HIGHThumbor has HMAC validation bypass via multiple .replace() calls when removing URL signatureEPSS 0.2%CVE-2026-44720MEDIUMOpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account TakeoverEPSS 0.2%CVE-2020-3138—Cisco Enterprise NFV Infrastructure Software Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-5050HIGHPayment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status ManipulationEPSS 0.2%CVE-2025-71402LOWbetter-auth before 1.4.0 Session Revocation via Forged CookieEPSS 0.2%CVE-2026-69646HIGHSkype for Business Spoofing VulnerabilityEPSS 0.2%CVE-2026-31946CRITICALOpenOLAT: Authentication bypass via forged JWT in OIDC implicit flowEPSS 0.2%CVE-2025-2763MEDIUMCarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution VulnerabilityEPSS 0.2%CVE-2021-1244MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2026-34872CRITICALAn issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH duEPSS 0.2%CVE-2021-1136MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2022-42793MEDIUMAn issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 1EPSS 0.2%CVE-2025-55311MEDIUMAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript tEPSS 0.2%CVE-2026-54774HIGHCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateEPSS 0.2%CVE-2025-12150LOWOrg.keycloak/keycloak-services: webauthn attestation statement verification bypassEPSS 0.2%CVE-2026-74876CRITICALopenssl_encrypt before 1.4.0 Unverified Key Bundle EncryptionEPSS 0.2%CVE-2026-34068MEDIUMnimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledgeEPSS 0.2%CVE-2026-72861MEDIUMAppwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is AbsentEPSS 0.2%CVE-2026-32144HIGHOCSP designated-responder authorization bypass via missing signature verificationEPSS 0.2%CVE-2026-41431HIGHZen Browser MAR updater ships with signature verification removed — unsigned updates acceptedEPSS 0.2%