Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-105118LOWOpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSessionEPSS 0.1%CVE-2024-27244MEDIUMZoom Workplace VDI App for Windows - Insufficient Verification of Data AuthenticityEPSS 0.1%CVE-2023-20236MEDIUMA vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified sofEPSS 0.1%CVE-2025-64740HIGHZoom Workplace VDI Client for Windows - Improper Verification of Cryptographic SignatureEPSS 0.1%CVE-2026-28199MEDIUMSensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS ShellEPSS 0.1%CVE-2026-91814MEDIUMSecurity vulnerability: Foxit PDF Editor/Reader Fails to Detect Modifications to Signed Documents Displaying Newly Added ContentEPSS 0.1%CVE-2026-65197LOWH3C G3/G5 HDM Firmware Verification Key ReplacementEPSS 0.1%CVE-2025-20248MEDIUMCisco IOS XR Software Image Verification Bypass VulnerabilityEPSS 0.1%CVE-2024-53267MEDIUMVulnerability with bundle verification in sigstore-javaEPSS 0.1%CVE-2026-87101MEDIUMSensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, WinEPSS 0.1%CVE-2026-75946HIGHOMEN Gaming Hub – Potential Escalation of Privilege & Information DisclosureEPSS 0.1%CVE-2026-45614MEDIUMOP-TEE vulnerable to ECDH private key recoveryEPSS 0.1%CVE-2026-52486MEDIUMAn issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument moduleEPSS 0.1%CVE-2025-64456HIGHIn JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalationEPSS 0.1%CVE-2023-20135MEDIUMA vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code onEPSS 0.1%CVE-2026-65632MEDIUMECDSA signature length is not validated in jose, allowing signature malleabilityEPSS 0.1%CVE-2026-47554HIGHNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatureEPSS 0.1%CVE-2026-71887HIGHOpenPGP data signature accepted from a signing subkey without cross-certificationEPSS 0.1%CVE-2024-23581MEDIUMHCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerabilityEPSS 0.1%CVE-2025-54549MEDIUMCryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISOEPSS 0.1%