Weaknesses of type CWE-41

42 results

Divulgação de Informações

É a exposição não intencional de dados sensíveis — credenciais, tokens, caminhos internos, versões de software — para um atacante ou usuário não autorizado. O risco reside em permitir que informações que deveriam ser privadas sejam acessadas, facilitando ataques subsequentes como escalação de privilégio ou reconhecimento da infraestrutura.

Example

Um endpoint de API retorna mensagens de erro detalhadas contendo queries SQL ou stack traces com caminhos do servidor; ou um arquivo de configuração é exposto publicamente no repositório Git; ou um token de API é visível em logs de cliente no navegador.

How to mitigate

Sanitize mensagens de erro para produção (sem detalhes técnicos), implemente controles de acesso adequados nos arquivos sensíveis, revise logs e respostas de API para não incluírem dados críticos, e use ferramentas de scanning para detectar credenciais em repositórios antes de publicar.

CVE-2026-73019MEDIUMWindows URL Moniker Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2024-6839MEDIUMImproper Regex Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2023-46169MEDIUMIBM DS8900F file manipulationEPSS 0.5%CVE-2026-72835HIGHfilebrowser before v2.63.21 Access Rule Bypass via Path CanonicalizationEPSS 0.5%CVE-2026-112343HIGHSyncplify Server! < 8.8.0 Permission Override Bypass via Path CasingEPSS 0.5%CVE-2026-93709MEDIUMDancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handlerEPSS 0.5%CVE-2026-66064MEDIUMgoshs has ACL Bypass & Path TraversalEPSS 0.4%CVE-2026-70184HIGHWindows Backup Engine Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-5816HIGHImproper Resolution of Path Equivalence in GitLabEPSS 0.4%CVE-2026-102231HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-34451MEDIUMClaude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling DirectoriesEPSS 0.4%CVE-2026-119200MEDIUMNuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesEPSS 0.3%CVE-2026-34510MEDIUMOpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media LoadersEPSS 0.3%CVE-2026-110725LOWfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesEPSS 0.3%CVE-2026-110095LOWfast-uri vulnerable to improper path equivalence in relative reference normalizationEPSS 0.3%CVE-2024-45405MEDIUMgix-path improperly resolves configuration path reported by GitEPSS 0.3%CVE-2025-43298HIGHA parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, mEPSS 0.2%CVE-2026-57441HIGHMCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalenceEPSS 0.2%CVE-2026-49401HIGHDeno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)EPSS 0.2%CVE-2025-0115MEDIUMPAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLIEPSS 0.2%