Weaknesses of type CWE-668

253 results

Divulgação de informações

O software expõe dados sensíveis (credenciais, tokens, dados pessoais, configs internas) a uma entidade não autorizada — seja por acesso direto, mensagens de erro verbosas, logs mal protegidos ou canais inseguros. É a falha de um controle de acesso ou encriptação que deveria manter esses dados privados.

Example

Uma API REST que retorna a senha do usuário em plain text na resposta de login; ou um servidor que deixa arquivos de backup (.sql, .env) acessíveis via web; ou um log de erro que exibe URLs internas e tokens de autenticação em páginas públicas.

How to mitigate

Classifique dados por sensibilidade, nunca exponha em respostas de erro ou logs públicos. Use encriptação em trânsito (TLS) e em repouso, aplique controle de acesso rigoroso aos arquivos sensíveis, e revise regularmente o que seu código imprime em mensagens e registros.

CVE-2021-1438MEDIUMCisco Wide Area Application Services Software Information Disclosure VulnerabilityEPSS 0.2%CVE-2026-42875MEDIUMExternal Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStoreEPSS 0.2%CVE-2026-79031LOWImproper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a craftEPSS 0.2%CVE-2021-1423MEDIUMCisco Aironet Access Points Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2026-41368HIGHOpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter BypassEPSS 0.2%CVE-2024-35183MEDIUMwolfictl leaks GitHub tokens to remote non-GitHub git serversEPSS 0.2%CVE-2026-112936MEDIUMfilelock: ReadWriteLock follows a symlink at the lock path into SQLiteEPSS 0.2%CVE-2025-55077MEDIUMTyler Technologies ERP Pro 9 SaaS application escapeEPSS 0.2%CVE-2025-12351MEDIUMInadequate access control measure allows unauthorized users to access restricted administrative functionsEPSS 0.2%CVE-2024-13484HIGHOpenshift-gitops-operator-container: namespace isolation breakEPSS 0.2%CVE-2026-59308MEDIUMSemantic Cache Cross-Tenant Isolation Bypass via SHA-256 TruncationEPSS 0.2%CVE-2023-4910MEDIUM3scale-admin-portal: logged out users tokens can be accessedEPSS 0.2%CVE-2026-105746LOWDocling: KServe v2 OCR engine does not enforce enable_remote_servicesEPSS 0.2%CVE-2026-2297MEDIUMSourcelessFileLoader does not use io.open_code()EPSS 0.2%CVE-2026-106354MEDIUMImproper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via aEPSS 0.2%CVE-2026-102262HIGHNewell Brands DYMO ID parent directory open to path traversal through improper spheres of controlEPSS 0.2%CVE-2026-57144HIGHPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableEPSS 0.2%CVE-2022-46756HIGH Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploiEPSS 0.2%CVE-2023-3670HIGHCodesys: Vulnerability in CODESYS Development System and CODESYS ScriptingEPSS 0.2%CVE-2026-53657HIGHLima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socketEPSS 0.2%