Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-45068HIGHSymfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressEPSS 0.5%CVE-2024-2422CRITICALLenelS2 NetBox Improper Neutralization of Argumented DelimitersEPSS 0.5%CVE-2026-24126MEDIUMWeblate has an argument injection in management consoleEPSS 0.5%CVE-2026-62867CRITICALIncus has an argument injection in storage volume block.create_options that leads to arbitrary command executionEPSS 0.5%CVE-2024-52011HIGHlaunch-editor vulnerable to command injection via the crafted request on WindowsEPSS 0.5%CVE-2024-32884MEDIUMgix-transport indirect code execution via malicious usernameEPSS 0.5%CVE-2024-32462HIGHFlatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsingEPSS 0.5%CVE-2022-4864MEDIUM Argument Injection in froxlor/froxlorEPSS 0.5%CVE-2026-52750HIGHGhidra < 12.1- Command Injection via URL Annotation ClickEPSS 0.5%CVE-2026-111813CRITICALApache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationEPSS 0.5%CVE-2026-43893HIGHexiftool-vendored: Argument injection via newline characters in tag namesEPSS 0.5%CVE-2023-30577HIGHAMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a differentEPSS 0.5%CVE-2025-12556HIGHIDIS ICM Viewer Argument InjectionEPSS 0.5%CVE-2026-85626HIGHgit-mcp-server 2.15.1 Argument Injection via Git Ref ParametersEPSS 0.5%CVE-2026-123014HIGHiTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary cEPSS 0.5%CVE-2026-73539HIGHGitea external renderer argument injection and code executionEPSS 0.5%CVE-2026-97798HIGHWindows Error Reporting Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-111504HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument InjeEPSS 0.5%CVE-2026-110858CRITICALGitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() RefspecEPSS 0.5%CVE-2026-86035HIGHWeblate: Mercurial argument injection via repository filenames allows authenticated command executionEPSS 0.5%