Weaknesses of type CWE-93

254 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2026-110835MEDIUMFreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing TokenEPSS 0.3%CVE-2026-49130MEDIUMMusic Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxxEPSS 0.3%CVE-2026-46739MEDIUMNet::Statsd versions before 0.13 for Perl allow metric injectionsEPSS 0.3%CVE-2026-9679MEDIUMundici vulnerable to HTTP header injection via Set-Cookie percent-decodingEPSS 0.3%CVE-2026-33635MEDIUMiCalendar has ICS injection via unsanitized URI property valuesEPSS 0.3%CVE-2026-34458CRITICALSandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnlyEPSS 0.3%CVE-2026-33606MEDIUMMail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync witEPSS 0.2%CVE-2026-86813MEDIUMMetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-ToEPSS 0.2%CVE-2026-71572MEDIUMJoomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2EPSS 0.2%CVE-2026-19862MEDIUMJetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email ActionEPSS 0.2%CVE-2026-113715LOWvirtualenv: Venv configuration readback can reinterpret path boundariesEPSS 0.2%CVE-2025-6175HIGHCRLF Injection in DECE Software's GeodiEPSS 0.2%CVE-2026-3633LOWLibsoup: libsoup: header and http request injection via crlf injectionEPSS 0.2%CVE-2026-26962MEDIUMRack: Header injection in multipart requestsEPSS 0.2%CVE-2026-2400MEDIUMCWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reEPSS 0.2%CVE-2026-55766MEDIUMguzzlehttp/psr7: CRLF Injection in HTTP Start-Line SerializationEPSS 0.2%CVE-2026-8788HIGHNet::Statsd::Lite versions through 0.10.0 for Perl allowed metric injectionsEPSS 0.2%CVE-2026-115303LOWContact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field MappingEPSS 0.2%CVE-2026-42586MEDIUMNetty: CRLF Injection in Netty Redis Codec EncoderEPSS 0.2%CVE-2025-54972LOWAn improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 thrEPSS 0.2%