Weaknesses of type CWE-668

253 results

Divulgação de informações

O software expõe dados sensíveis (credenciais, tokens, dados pessoais, configs internas) a uma entidade não autorizada — seja por acesso direto, mensagens de erro verbosas, logs mal protegidos ou canais inseguros. É a falha de um controle de acesso ou encriptação que deveria manter esses dados privados.

Example

Uma API REST que retorna a senha do usuário em plain text na resposta de login; ou um servidor que deixa arquivos de backup (.sql, .env) acessíveis via web; ou um log de erro que exibe URLs internas e tokens de autenticação em páginas públicas.

How to mitigate

Classifique dados por sensibilidade, nunca exponha em respostas de erro ou logs públicos. Use encriptação em trânsito (TLS) e em repouso, aplique controle de acesso rigoroso aos arquivos sensíveis, e revise regularmente o que seu código imprime em mensagens e registros.

CVE-2019-12660MEDIUMCisco IOS XE Software ASIC Register Write VulnerabilityEPSS 0.3%CVE-2026-33573HIGHOpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC ParametersEPSS 0.3%CVE-2021-41989HIGHQlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions.EPSS 0.3%CVE-2021-41988HIGHQlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.EPSS 0.3%CVE-2024-21605HIGHJunos OS: SRX 300 Series: Specific link local traffic causes a control plane overloadEPSS 0.3%CVE-2024-42350LOWPublic key confusion in third party block in BiscuitEPSS 0.3%CVE-2026-50202MEDIUMSteeltoe's static JWKS cache shared across schemes and never invalidatedEPSS 0.3%CVE-2026-35658MEDIUMOpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image ToolEPSS 0.3%CVE-2025-49574MEDIUMQuarkus potential data leak when duplicating a duplicated contextEPSS 0.3%CVE-2025-3651CRITICALCommand Injection in iManage Work Desktop for Mac's Agent ServiceEPSS 0.3%CVE-2021-33096MEDIUMImproper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticateEPSS 0.3%CVE-2026-41362LOWOpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared AuthenticationEPSS 0.3%CVE-2022-39349MEDIUMTasks.org vulnerable to data exfiltration by malicous app or adbEPSS 0.3%CVE-2026-105754MEDIUMvLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresEPSS 0.3%CVE-2026-79068MEDIUMImproper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin EPSS 0.3%CVE-2022-22732LOWA CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) suppEPSS 0.3%CVE-2026-72924LOWGitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by defaultEPSS 0.3%CVE-2026-70606MEDIUMElectron: ProtocolResponse.url reuses the default session cache instead of the registering sessionEPSS 0.3%CVE-2022-24913MEDIUMVersions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProviderEPSS 0.3%CVE-2021-34723MEDIUMCisco IOS XE SD-WAN Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%