Weaknesses of type CWE-347

766 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2026-116116CRITICALYoosee GM8135S Camera Secure Boot signature verificationEPSS 0.1%CVE-2026-118040HIGHImproper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessingEPSS 0.1%CVE-2026-2625MEDIUMRust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verificationEPSS 0.1%CVE-2026-91899MEDIUMDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerabilityEPSS 0.1%CVE-2026-0392HIGHeParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-updateEPSS 0.1%CVE-2026-4541LOWjanmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verificationEPSS 0.1%CVE-2025-30064HIGHPossibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT keyEPSS 0.1%CVE-2025-46774MEDIUMAn Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version EPSS 0.1%CVE-2026-91905MEDIUMDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privEPSS 0.1%CVE-2024-36334HIGHImproper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory toEPSS 0.1%CVE-2026-17872MEDIUMCryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a saEPSS 0.1%CVE-2026-79807HIGHAuthenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in the ClearPass Policy Manager Windows Client SoftwareEPSS 0.1%CVE-2025-23364MEDIUMA vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly validates code signingEPSS 0.1%CVE-2026-109838MEDIUMIBM Db2 Genius Hub Improper verification of cryptographic signatureEPSS 0.1%CVE-2026-106581HIGHDocker Desktop for Windows installer failed to verify external packagesEPSS 0.1%CVE-2026-117549MEDIUM@fastify/secure-session vulnerable to signature verification bypass via cookie signature removalEPSS 0.1%CVE-2025-71422MEDIUMContrast before 1.12.1 Insecure LUKS2 Persistent StorageEPSS 0.1%CVE-2026-48791LOWSigstore Java has a vulnerability with bundle verification of integratedTimeEPSS 0.1%CVE-2026-118768MEDIUMBotan: CLI utility `ocsp_check` accepts unauthenticated responsesEPSS 0.1%CVE-2026-77805HIGHWeak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® ClassicEPSS 0.1%