Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2025-61884HIGHVulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected aEPSS 95.9%KEVCVE-2022-0666HIGHCRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweberEPSS 44.3%CVE-2016-3115MEDIUMMultiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended sheEPSS 35.5%CVE-2024-20337HIGHA vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriEPSS 29.9%CVE-2021-39172HIGHNew line injection during configuration editionEPSS 29.2%CVE-2019-9740MEDIUMAn issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the atEPSS 5.4%CVE-2019-9947MEDIUMAn issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the atEPSS 5.3%CVE-2023-4767MEDIUMImproper Neutralization of CRLF Sequences in ManageEngine Desktop CentralEPSS 3.5%CVE-2023-4768MEDIUMImproper Neutralization of CRLF Sequences in ManageEngine Desktop CentralEPSS 3.5%CVE-2022-31014MEDIUMSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerEPSS 2.5%CVE-2018-12537—In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and linEPSS 2.5%CVE-2020-11078MEDIUMCRLF injection in httplib2EPSS 2.4%CVE-2021-31164—Apache Unomi log injectionEPSS 2.3%CVE-2026-39983HIGHFTP Command Injection via CRLF in basic-ftpEPSS 2.2%CVE-2026-72590CRITICALalseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars ParameterEPSS 2.0%CVE-2026-82854CRITICALNodemailer before 8.0.4 SMTP Command Injection via envelope.sizeEPSS 2.0%CVE-2025-57804MEDIUMh2 allows HTTP Request Smuggling due to illegal characters in headersEPSS 1.9%CVE-2026-111228MEDIUMNetgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.phpEPSS 1.8%CVE-2026-111227MEDIUMNetgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.phpEPSS 1.8%CVE-2025-59419MEDIUMNetty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email ForgeryEPSS 1.6%