Weaknesses of type CWE-347

763 results

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, PII, tokens) através de canais não seguros, logs, mensagens de erro ou comportamentos observáveis. O risco é um atacante capturar essas informações e usá-las para escalar privilégios, contornar autenticação ou comprometer outros sistemas.

Example

Uma API retorna stack traces detalhados em respostas de erro que revelam caminhos de arquivo, versões de bibliotecas e nomes de banco de dados; ou credenciais de acesso aparecem em logs de aplicação armazenados sem criptografia em um servidor comprometido.

How to mitigate

Remova informações técnicas sensíveis de mensagens de erro (envie logs detalhados apenas para backend seguro), criptografe dados em trânsito e em repouso, implemente controle de acesso a logs e trace requests com IDs genéricos. Use ferramentas de scanning estático para detectar exposição de hardcoded secrets.

CVE-2020-24439LOWAcrobat Reader DC for macOS Signature Validation BypassEPSS 0.6%CVE-2024-47943CRITICALImproper signature verification of firmware upgrade filesEPSS 0.6%CVE-2024-21669CRITICALHyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VCEPSS 0.6%CVE-2024-42461MEDIUMIn the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.EPSS 0.6%CVE-2024-13990CRITICALMicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of UpdatesEPSS 0.6%CVE-2023-22742MEDIUMlibgit2 fails to verify SSH keys by defaultEPSS 0.6%CVE-2020-3308MEDIUMCisco Firepower Threat Defense Software Signature Verification Bypass VulnerabilityEPSS 0.6%CVE-2026-62873CRITICALMicrosoft 365 Admin Center Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-9485CRITICALOAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()EPSS 0.6%CVE-2025-33074HIGHAzure Functions Remote Code Execution VulnerabilityEPSS 0.6%CVE-2021-29500HIGHMissing validation of JWT signatureEPSS 0.6%CVE-2023-28610CRITICALThe update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update imaEPSS 0.6%CVE-2021-3051HIGHCortex XSOAR: Authentication Bypass in SAML AuthenticationEPSS 0.6%CVE-2025-13662HIGHImproper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1EPSS 0.6%CVE-2023-39969CRITICALuthenticode signature validation bypass vulnerabilityEPSS 0.6%CVE-2026-14497HIGHIBM DataPower Gateway Improper Verification of Cryptographic SignatureEPSS 0.6%CVE-2026-27962CRITICALAuthlib JWS JWK Header Injection: Signature Verification BypassEPSS 0.6%CVE-2019-10136MEDIUMIt was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired,EPSS 0.6%CVE-2023-46234MEDIUMbrowserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attackEPSS 0.6%CVE-2023-5747HIGHCommand injection via wave install fileEPSS 0.6%