Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2024-3775MEDIUMaEnrich Technology a+HRD - Argument InjectionEPSS 0.4%CVE-2026-42601CRITICALArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddViewEPSS 0.4%CVE-2026-54686MEDIUMWarp: DCS lifecycle hook spoofing can alter terminal session metadataEPSS 0.4%CVE-2026-78637MEDIUMFdawgs node-poppler Argument Injection index.js pdfUnite argument injectionEPSS 0.4%CVE-2025-29768MEDIUMVim vulnerable to potential data loss with zip.vim and special crafted zip filesEPSS 0.4%CVE-2025-40948MEDIUMA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEEPSS 0.4%CVE-2020-1738LOWA flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task iEPSS 0.4%CVE-2025-27146LOWMatrix IRC Bridge allows IRC command injection to own puppeted userEPSS 0.4%CVE-2026-43941CRITICALUnvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link clickEPSS 0.4%CVE-2026-90467MEDIUMaiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addressesEPSS 0.4%CVE-2025-12613HIGHVersions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values cEPSS 0.4%CVE-2023-0633HIGHIn Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPEEPSS 0.4%CVE-2026-110859HIGHGitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NameEPSS 0.4%CVE-2026-74237HIGHGFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf ClientEPSS 0.4%CVE-2026-84256HIGHAn argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to exEPSS 0.4%CVE-2025-47421HIGHPrivilege escalation via SCP loginEPSS 0.4%CVE-2026-79685MEDIUMDell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vEPSS 0.4%CVE-2026-44450CRITICALLumiverse: RCE via MCP stdio argument injectionEPSS 0.4%CVE-2026-17062LOWMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%CVE-2023-22632LOWPRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.EPSS 0.4%