Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2021-41832—Content Manipulation with Certificate Validation AttackEPSS 1.3%CVE-2023-5347CRITICALUnauthenticated Firmware UpgradeEPSS 1.3%CVE-2022-26510CRITICALA firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. A specially-crafteEPSS 1.3%CVE-2021-21239MEDIUMOpen default xmlsec1 key-type preferenceEPSS 1.3%CVE-2021-1366HIGHCisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking VulnerabilityEPSS 1.3%CVE-2024-47073CRITICALDataease arbitrary interface access vulnerabilityEPSS 1.3%CVE-2021-3033CRITICALPrisma Cloud Compute: SAML Authentication Bypass Vulnerability in ConsoleEPSS 1.2%CVE-2020-5407—Signature Wrapping Vulnerability with spring-security-saml2-service-providerEPSS 1.2%CVE-2020-11093HIGHAuthorization bypass in Hyperledger IndyEPSS 1.2%CVE-2022-42010MEDIUMAn issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can caEPSS 1.1%CVE-2021-3445—A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code exEPSS 1.1%CVE-2022-24772HIGHImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.1%CVE-2021-21238MEDIUMSAML XML Signature wrappingEPSS 1.1%CVE-2020-9753—Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.EPSS 1.1%CVE-2021-34715MEDIUMCisco Expressway Series and TelePresence Video Communication Server Image Verification VulnerabilityEPSS 1.1%CVE-2026-0265HIGHPAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabledEPSS 1.1%CVE-2022-24884CRITICALTrivial signature forgery in ecdsautilsEPSS 1.0%CVE-2022-31053CRITICALSignature forgery in BiscuitEPSS 1.0%CVE-2023-41764MEDIUMMicrosoft Office Spoofing VulnerabilityEPSS 1.0%CVE-2021-22734—Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could EPSS 1.0%