Weaknesses of type CWE-88

311 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-16796HIGHImproper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()EPSS 0.7%CVE-2026-27947CRITICALGroup-Office Vulnerable to Remote Code Execution (RCE)EPSS 0.7%CVE-2020-7851HIGHInnorix File Transfer Solution File Download and Execution VulnerabilityEPSS 0.7%CVE-2026-76218HIGHGitPython before 3.1.58 Remote Code Execution via Repo.initEPSS 0.7%CVE-2026-89036HIGHAppwrite < 2.0.0 Argument Injection via providerRootDirectory ParameterEPSS 0.7%CVE-2026-47114HIGHIINA < 1.4.3 Command Execution via iina://open URL SchemeEPSS 0.7%CVE-2024-39933HIGHGogs through 0.13.0 allows argument injection during the tagging of a new release.EPSS 0.7%CVE-2026-72538HIGHPrefectHQ Prefect - Argument InjectionEPSS 0.7%CVE-2020-7808HIGHRAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerabilityEPSS 0.7%CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.7%CVE-2026-48793HIGHJellyfin: Potential FFmpeg argument injection via unescaped subtitle file pathEPSS 0.7%CVE-2026-22582CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MEPSS 0.7%CVE-2026-22583CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CEPSS 0.7%CVE-2026-27208CRITICALapi-gateway-deploy Affected by Exploitable Command Injection via Unprivileged Root ExecutionEPSS 0.7%CVE-2025-3945HIGHImproper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)EPSS 0.7%CVE-2022-36322MEDIUMIn JetBrains TeamCity before 2022.04.2 build parameter injection was possibleEPSS 0.6%CVE-2025-53542HIGHKubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSignEPSS 0.6%CVE-2025-52480HIGHRegistrator.jl Argument Injection VulnerabilityEPSS 0.6%CVE-2026-42266HIGHJupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.EPSS 0.6%CVE-2024-22182HIGHCommend WS203VICM Argument InjectionEPSS 0.6%