Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-84185MEDIUMJwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationEPSS 0.1%CVE-2025-34503HIGHShuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware ExecutionEPSS 0.1%CVE-2025-12007HIGHSupermicro BMC firmware update validation bypassEPSS 0.1%CVE-2026-41005CRITICALUAA accepts SAML Encrypted Assertions authentication bypassEPSS 0.1%CVE-2026-103329MEDIUMSuper Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook SignatureEPSS 0.1%CVE-2025-0824LOWlack of validation for firmware update in Hitachi Virtual StorageEPSS 0.1%CVE-2026-56865HIGHFix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogEPSS 0.1%CVE-2024-5912MEDIUMCortex XDR Agent: Improper File Signature Verification ChecksEPSS 0.1%CVE-2026-50720MEDIUMThe Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32EPSS 0.1%CVE-2026-48523MEDIUMPyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keysEPSS 0.1%CVE-2026-42193CRITICALPlunk: SNS webhook forgeryEPSS 0.1%CVE-2025-43468MEDIUMA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS EPSS 0.1%CVE-2024-23460MEDIUMIncorrect signature validation of packageEPSS 0.1%CVE-2024-47476HIGHDell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability. An unauthEPSS 0.1%CVE-2025-27498MEDIUMAEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failureEPSS 0.1%CVE-2025-52648MEDIUMHCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverifieEPSS 0.1%CVE-2026-85995HIGHNotepad++: Authenticode verification bypass allows modified updater executionEPSS 0.1%CVE-2026-84465HIGHZammad: S/MIME signature verification allows forged sender impersonationEPSS 0.1%CVE-2024-38807MEDIUMCVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's LoaderEPSS 0.1%CVE-2026-78860HIGHAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintextEPSS 0.1%