Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-48793HIGHJellyfin: Potential FFmpeg argument injection via unescaped subtitle file pathEPSS 0.7%CVE-2026-17410CRITICALMultiple Vulnerabilities in IBM API ConnectEPSS 0.7%CVE-2026-87900CRITICALArgument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute aEPSS 0.7%CVE-2026-73294CRITICALSemaphore U: OS Command InjectionEPSS 0.7%CVE-2025-49008CRITICALAtheos Improper Input Validation Vulnerability Enables RCE in Common.phpEPSS 0.6%CVE-2026-32304CRITICALLocutus: RCE via unsanitized input in create_function()EPSS 0.6%CVE-2026-22582CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MEPSS 0.6%CVE-2026-22583CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CEPSS 0.6%CVE-2025-59489HIGHUnity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code fEPSS 0.6%CVE-2025-32458HIGHON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument InjectionEPSS 0.6%CVE-2025-32459HIGHON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument InjectionEPSS 0.6%CVE-2025-32455HIGHON Semiconductor Quantenna router_command.sh (in the run_cmd argument) Argument InjectionEPSS 0.6%CVE-2025-3459HIGHON Semiconductor Quantenna transmit_file Argument InjectionEPSS 0.6%CVE-2025-32456HIGHON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument InjectionEPSS 0.6%CVE-2025-32457HIGHON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument InjectionEPSS 0.6%CVE-2026-54337CRITICALFireshare has Unauthenticated Argument Injection to Arbitrary File Write/OverwriteEPSS 0.6%CVE-2026-84502CRITICALAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podEPSS 0.6%CVE-2026-53790CRITICALrsync < 3.5.0 Command Injection via Multiple Code PathsEPSS 0.6%CVE-2020-3380HIGHCisco Data Center Network Manager Privilege Escalation VulnerabilityEPSS 0.6%CVE-2025-53542HIGHKubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSignEPSS 0.6%