Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-76218HIGHGitPython before 3.1.58 Remote Code Execution via Repo.initEPSS 0.7%CVE-2026-17347HIGHpgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitutionEPSS 0.7%CVE-2026-112944MEDIUMlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsEPSS 0.7%CVE-2026-96620CRITICALClaude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command ExecutionEPSS 0.7%CVE-2026-47114HIGHIINA < 1.4.3 Command Execution via iina://open URL SchemeEPSS 0.7%CVE-2026-89036HIGHAppwrite < 2.0.0 Argument Injection via providerRootDirectory ParameterEPSS 0.7%CVE-2026-105789MEDIUMMicrosoft UFO: Arbitrary file write in the Linux MCP `execute_command` toolEPSS 0.7%CVE-2026-49987HIGHRepomix: Command Injection (RCE) via `--remote-branch` Argument InjectionEPSS 0.7%CVE-2024-39933HIGHGogs through 0.13.0 allows argument injection during the tagging of a new release.EPSS 0.7%CVE-2020-7808HIGHRAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerabilityEPSS 0.7%CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.7%CVE-2025-52480HIGHRegistrator.jl Argument Injection VulnerabilityEPSS 0.7%CVE-2026-91909MEDIUMDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument InjeEPSS 0.7%CVE-2026-107639HIGHILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload FilenameEPSS 0.7%CVE-2026-63046HIGHApache InLong: Agent Installer — Command Injection to RCE via Default CredentialsEPSS 0.7%CVE-2026-108390CRITICALHestiaCP Low-Privileged User to Root via Config-Field Injection and PATH HijackingEPSS 0.7%CVE-2022-36322MEDIUMIn JetBrains TeamCity before 2022.04.2 build parameter injection was possibleEPSS 0.7%CVE-2026-8044HIGHCWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote codeEPSS 0.7%CVE-2026-28197CRITICALPrivilege Escalation via Argument Injection in NetBackup Flex OS ShellEPSS 0.7%CVE-2026-113708CRITICALArgo CD: A Kustomize remote ref can run commands in the repo-serverEPSS 0.7%