Weaknesses of type CWE-88

378 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-4145HIGHDuring an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticatEPSS 0.2%CVE-2025-24845MEDIUMImproper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.EPSS 0.2%CVE-2026-41570HIGHPHPUnit: Argument injection via newline in PHP INI values forwarded to child processesEPSS 0.2%CVE-2025-67858HIGHA crafted "interface" input parameter can lead to integrity loss of the firewall configurationEPSS 0.2%CVE-2026-87667HIGHAn argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d EPSS 0.2%CVE-2026-11968MEDIUMImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') in TortoiseGitEPSS 0.2%CVE-2025-41761HIGHPrivilege escalation possibleEPSS 0.2%CVE-2026-52817HIGHLinuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalationEPSS 0.2%CVE-2026-64624HIGHFreeRDP RDP File Parser Remote Code Execution via CLI OptionsEPSS 0.2%CVE-2026-11939LOWSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.2%CVE-2026-75131HIGHNetworkManager-l2tp Privilege Escalation via pppd Username InjectionEPSS 0.2%CVE-2026-97350MEDIUMLocal Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for WindowsEPSS 0.2%CVE-2026-68939LOWPyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)EPSS 0.2%CVE-2026-11765LOWArgument Injection in TUBITAK BILGEM's Pardus PenEPSS 0.2%CVE-2026-1715MEDIUMAn input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow aEPSS 0.2%CVE-2026-1716MEDIUMAn input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow aEPSS 0.2%CVE-2026-90894HIGHParallels Desktop local privilege escalation via appliance extract argument injectionEPSS 0.2%CVE-2026-1717MEDIUMAn input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allEPSS 0.2%CVE-2026-43943HIGHelecterm: RCE via malicious SSH server filename in openFileWithEditorEPSS 0.2%CVE-2026-121749MEDIUMnvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local filesEPSS 0.2%