Weaknesses of type CWE-347

640 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2021-1366HIGHCisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking VulnerabilityEPSS 1.3%CVE-2024-47073CRITICALDataease arbitrary interface access vulnerabilityEPSS 1.3%CVE-2021-3033CRITICALPrisma Cloud Compute: SAML Authentication Bypass Vulnerability in ConsoleEPSS 1.2%CVE-2020-5407—Signature Wrapping Vulnerability with spring-security-saml2-service-providerEPSS 1.2%CVE-2020-11093HIGHAuthorization bypass in Hyperledger IndyEPSS 1.2%CVE-2021-3445—A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code exEPSS 1.1%CVE-2022-24772HIGHImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.1%CVE-2021-21238MEDIUMSAML XML Signature wrappingEPSS 1.1%CVE-2020-9753—Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.EPSS 1.1%CVE-2021-34715MEDIUMCisco Expressway Series and TelePresence Video Communication Server Image Verification VulnerabilityEPSS 1.1%CVE-2026-0265HIGHPAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabledEPSS 1.1%CVE-2022-24884CRITICALTrivial signature forgery in ecdsautilsEPSS 1.0%CVE-2022-31053CRITICALSignature forgery in BiscuitEPSS 1.0%CVE-2023-41764MEDIUMMicrosoft Office Spoofing VulnerabilityEPSS 1.0%CVE-2021-22734—Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could EPSS 1.0%CVE-2021-22735—Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could aEPSS 1.0%CVE-2020-26290CRITICALCritical security issues in XML encoding in DexEPSS 1.0%CVE-2021-21405MEDIUMBLS Signature "Malleability"EPSS 1.0%CVE-2020-35169CRITICALDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper InpEPSS 1.0%CVE-2017-13083MEDIUMAkeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attEPSS 1.0%