Weaknesses of type CWE-88

380 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2025-52459HIGHAdvantech iView Argument InjectionEPSS 0.3%CVE-2026-2449CRITICALImproper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant PrivEPSS 0.3%CVE-2020-27129MEDIUMCisco SD-WAN vManage Software Command Injection VulnerabilityEPSS 0.3%CVE-2026-4519HIGHwebbrowser.open() allows leading dashes in URLsEPSS 0.3%CVE-2026-35033CRITICALJellyfin: Potential SSRF + Arbitrary file read via stream argument injectionEPSS 0.3%CVE-2026-50014MEDIUMpnpm: Git Fetch Argument Injection via Lockfile resolution.commitEPSS 0.3%CVE-2024-3367MEDIUMArgument injection to runmqscEPSS 0.3%CVE-2026-4438MEDIUMgethostbyaddr and gethostbyaddr_r return invalid DNS hostnamesEPSS 0.3%CVE-2026-34769HIGHElectron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferenceEPSS 0.3%CVE-2026-3515HIGHArgument Injection in prefecthq/prefectEPSS 0.3%CVE-2026-107510CRITICALAuthenticated argument injection in NIOS command line leading to privilege escalationEPSS 0.3%CVE-2026-4786HIGHIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()EPSS 0.3%CVE-2026-84724MEDIUMAutomation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage processEPSS 0.3%CVE-2026-81529HIGHConnection-option injection via unescaped settings in the canonical MongoDB URL builderEPSS 0.3%CVE-2026-87794HIGHbestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip DestinationEPSS 0.3%CVE-2026-29954HIGHIn KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of EPSS 0.3%CVE-2024-51532HIGHDell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privilegEPSS 0.3%CVE-2026-16493HIGHAnsible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)EPSS 0.3%CVE-2026-104715HIGHCifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypassEPSS 0.3%CVE-2026-3682MEDIUMwelovemedia FFmate ffmpeg.go Execute argument injectionEPSS 0.3%