Weaknesses of type CWE-347

763 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2022-41340HIGHThe secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.EPSS 0.7%CVE-2016-7064—A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakageEPSS 0.7%CVE-2022-23610CRITICALImproper Verification of Cryptographic Signature in wire-serverEPSS 0.7%CVE-2022-35930HIGHAbility to bypass attestation verification in sigstore PolicyControllerEPSS 0.7%CVE-2022-35929HIGHFalse positive signature verification in cosignEPSS 0.7%CVE-2026-9779HIGHATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-46176MEDIUMCargo did not verify SSH host keysEPSS 0.7%CVE-2023-28226MEDIUMWindows Enroll Engine Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2026-102866HIGHMicrosoft Office SharePoint Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2021-32685CRITICALImproper Verification of Cryptographic Signature in tenvoyEPSS 0.7%CVE-2021-3406—A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust EPSS 0.7%CVE-2021-22708—A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to EPSS 0.7%CVE-2022-39237MEDIUMDigital Signature Hash Algorithms Not Validated in sylabs/sifEPSS 0.7%CVE-2021-3421—A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seeminglyEPSS 0.6%CVE-2025-47934HIGHOpenPGP.js's message signature verification can be spoofedEPSS 0.6%CVE-2022-23655MEDIUMMissing server signature validation in OctoberCMSEPSS 0.6%CVE-2026-59243CRITICALApache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)EPSS 0.6%CVE-2021-32977HIGHAVEVA System Platform Improper Verification of Cryptographic SignatureEPSS 0.6%CVE-2026-57098HIGHMicrosoft Remote Desktop App for Windows Information Disclosure VulnerabilityEPSS 0.6%CVE-2020-24439LOWAcrobat Reader DC for macOS Signature Validation BypassEPSS 0.6%