Weaknesses of type CWE-347

642 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2023-28806MEDIUMSignature validation error in DLL allows disabling anti-tampering protectionEPSS 0.2%CVE-2024-2307MEDIUMOsbuild-composer: race condition may disable gpg verification for package repositoriesEPSS 0.2%CVE-2025-55278HIGHHCL DevOps Loop is susceptible to an improper authentication vulnerabilityEPSS 0.2%CVE-2026-42784HIGHSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusionEPSS 0.2%CVE-2026-19910HIGHPAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-82461HIGHpac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access TokenEPSS 0.2%CVE-2019-1808MEDIUMCisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification VulnerabilityEPSS 0.2%CVE-2026-58200HIGH@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter SigningEPSS 0.2%CVE-2019-0071HIGHJunos OS: EX2300, EX3400 Series: Veriexec signature checking not enforced in specific versions of Junos OSEPSS 0.2%CVE-2025-15598MEDIUMDataease SQLBot JWT Token auth.py validateEmbedded signature verificationEPSS 0.2%CVE-2025-67903MEDIUMNorthern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.EPSS 0.2%CVE-2025-15469MEDIUM'openssl dgst' one-shot codepath silently truncates inputs >16MBEPSS 0.2%CVE-2021-34708MEDIUMCisco IOS XR Software for Cisco 8000 and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2023-41337MEDIUMh2o vulnerable to TLS session resumption misdirectionEPSS 0.2%CVE-2019-1809MEDIUMCisco NX-OS Software Patch Signature Verification Bypass VulnerabilityEPSS 0.2%CVE-2026-16443HIGHKeycloak-services: keycloak-services: saml broker metadata import disables response signature validationEPSS 0.2%CVE-2026-54736HIGHPhalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)EPSS 0.2%CVE-2026-67278MEDIUMTLS server impersonation possible in Mikrotik RouterOSEPSS 0.2%CVE-2021-26391HIGHInsufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gaEPSS 0.2%CVE-2026-22866LOWENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding ValidationEPSS 0.2%