Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2025-49520HIGHEvent-driven-ansible: authenticated argument injection in git url in eda project creationEPSS 0.6%CVE-2026-25689MEDIUMAn improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeEPSS 0.6%CVE-2025-3945HIGHImproper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)EPSS 0.6%CVE-2024-22182HIGHCommend WS203VICM Argument InjectionEPSS 0.6%CVE-2025-46835HIGHGit GUI can create and overwrite files for which the user has write permissionEPSS 0.6%CVE-2025-61731HIGHArbitrary file write using cgo pkg-config directive in cmd/goEPSS 0.6%CVE-2022-46883HIGHMozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in FirEPSS 0.6%CVE-2026-55673HIGHPowSyBl: Command Injection in LocalCommandExecutor-sEPSS 0.6%CVE-2019-5013HIGHAn exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLauncEPSS 0.6%CVE-2024-21533MEDIUMAll versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL EPSS 0.6%CVE-2026-44210MEDIUMKata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod AnnotationsEPSS 0.6%CVE-2026-76220HIGHGitPython before 3.1.58 Command Execution via split_single_char_optionsEPSS 0.6%CVE-2025-32931CRITICALDevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands vEPSS 0.6%CVE-2026-86864HIGHpgAdmin 4: Argument and connection-string injection via the database field in the Backup toolEPSS 0.6%CVE-2021-21384MEDIUMNull characters not escaped in shescapeEPSS 0.6%CVE-2026-102827HIGHsimple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)EPSS 0.6%CVE-2026-76866HIGHNetcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS ParametersEPSS 0.6%CVE-2026-42284HIGHGitPython: Unsafe option check validates multi_options before shlex.split transforms itEPSS 0.6%CVE-2022-44731MEDIUMA vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035EPSS 0.6%CVE-2026-6437MEDIUMAWS EFS CSI Driver Mount Option InjectionEPSS 0.6%