Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-17062LOWMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%CVE-2026-20016MEDIUMA vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authentEPSS 0.4%CVE-2026-48116HIGHAnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skillEPSS 0.4%CVE-2026-123281HIGHIn JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount brokerEPSS 0.4%CVE-2026-115372CRITICALIncus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_optionsEPSS 0.4%CVE-2026-73621MEDIUMGitPython before 3.1.56 Arbitrary File Truncation via Commit.countEPSS 0.4%CVE-2026-100369HIGHCliInvoke: Argument Injection in Extensibility Runner FactoryEPSS 0.4%CVE-2026-18740HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2026-18157HIGHYggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injectionEPSS 0.4%CVE-2026-110930HIGHCodex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project iEPSS 0.4%CVE-2026-86862HIGHpgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance toolsEPSS 0.4%CVE-2025-23073LOWAPI list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameterEPSS 0.3%CVE-2025-53509HIGHAdvantech iView Argument InjectionEPSS 0.3%CVE-2026-50056HIGHZimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument InjectionEPSS 0.3%CVE-2026-0304MEDIUMCortex XDR Broker VM: Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-12530HIGHImproper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()EPSS 0.3%CVE-2026-92892CRITICALPotential command execution on the host running JFrog CLI.EPSS 0.3%CVE-2026-50147HIGHMetabase: Arbitrary File Read via MySQL Connection Property InjectionEPSS 0.3%CVE-2025-43905MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.3%CVE-2021-1485MEDIUMCisco IOS XR Software Command Injection VulnerabilityEPSS 0.3%