Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2024-39711CRITICALArgument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a EPSS 1.7%CVE-2024-39712CRITICALArgument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a rEPSS 1.7%CVE-2024-38655CRITICALArgument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18EPSS 1.7%CVE-2024-11633CRITICALArgument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve EPSS 1.7%CVE-2026-40079HIGHCacti: Command Injection via escape_command() no-op in RRDtool executionEPSS 1.7%CVE-2017-1001003—math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creatinEPSS 1.7%CVE-2026-108963HIGHdatabasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can bEPSS 1.7%CVE-2024-20287MEDIUMA vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point SetupEPSS 1.6%CVE-2021-34718HIGHCisco IOS XR Software Arbitrary File Read and Write VulnerabilityEPSS 1.6%CVE-2021-41146HIGHArbitrary command execution on Windows in qutebrowserEPSS 1.5%CVE-2026-90868CRITICALOS Command Injection in Progress WS_FTP ServerEPSS 1.5%CVE-2022-42968CRITICALGitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.EPSS 1.4%CVE-2024-9131HIGHA user with administrator privileges can perform command injectionEPSS 1.4%CVE-2023-50232HIGHInductive Automation Ignition getParams Argument Injection Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-3817CRITICALHashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git BranchesEPSS 1.3%CVE-2026-112900CRITICALPillow: Argument Injection in Ghostscript call, potentially leading into RCEEPSS 1.3%CVE-2022-31749MEDIUMAuthenticated arbitrary file read/write in WatchGuard Fireware OSEPSS 1.3%CVE-2025-21613CRITICALgo-git has an Argument Injection via the URL fieldEPSS 1.3%CVE-2023-44452HIGHLinux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-49096HIGHArgument Injection in FFmpeg codec parameters in JellyfinEPSS 1.3%