Weaknesses of type CWE-668

253 results

Divulgação de informações

O software expõe dados sensíveis (credenciais, tokens, dados pessoais, configs internas) a uma entidade não autorizada — seja por acesso direto, mensagens de erro verbosas, logs mal protegidos ou canais inseguros. É a falha de um controle de acesso ou encriptação que deveria manter esses dados privados.

Example

Uma API REST que retorna a senha do usuário em plain text na resposta de login; ou um servidor que deixa arquivos de backup (.sql, .env) acessíveis via web; ou um log de erro que exibe URLs internas e tokens de autenticação em páginas públicas.

How to mitigate

Classifique dados por sensibilidade, nunca exponha em respostas de erro ou logs públicos. Use encriptação em trânsito (TLS) e em repouso, aplique controle de acesso rigoroso aos arquivos sensíveis, e revise regularmente o que seu código imprime em mensagens e registros.

CVE-2026-47141MEDIUMvm2: NodeVM observability builtins leak host process and HTTP request dataEPSS 0.4%CVE-2025-8107MEDIUMIn OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executiEPSS 0.4%CVE-2026-115522MEDIUMCross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for PythonEPSS 0.4%CVE-2024-21597MEDIUMJunos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filtersEPSS 0.4%CVE-2026-113328CRITICALImproper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crEPSS 0.4%CVE-2025-21608MEDIUMForged packets over MQTT can show up in direct messages in Meshtastic firmwareEPSS 0.4%CVE-2020-16212—Philips Patient Monitoring Devices Exposure of Resource to Wrong SphereEPSS 0.4%CVE-2026-121168HIGHImproper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to exEPSS 0.4%CVE-2022-45935MEDIUMApache James server: Temporary File Information DisclosureEPSS 0.4%CVE-2024-5313MEDIUMCWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This doEPSS 0.4%CVE-2026-104073MEDIUMNetBox 2.9.5 < 4.7.0 Session Hijacking via Custom LinksEPSS 0.4%CVE-2025-25176CRITICALGPU DDK - GPU Register value contents leaked from secure workloads to non-secure worldEPSS 0.4%CVE-2026-61590HIGHdjust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUGEPSS 0.4%CVE-2021-39212MEDIUMIssue when Configuring the ImageMagick Security PolicyEPSS 0.4%CVE-2026-113126CRITICALImproper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy EPSS 0.4%CVE-2024-32473MEDIUMMoby IPv6 enabled on IPv4-only network interfacesEPSS 0.4%CVE-2026-82650MEDIUMSiYuan before v3.8.1 Path Traversal via /api/template/renderEPSS 0.4%CVE-2024-24562MEDIUMSecurity headers not set in vantage6-UIEPSS 0.3%CVE-2026-8958HIGHInformation disclosure, sandbox escape in the Security: Process Sandboxing componentEPSS 0.3%CVE-2026-82652MEDIUMSiYuan before v3.8.1 Information Disclosure via Publish AccessEPSS 0.3%