Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2026-49214MEDIUMguzzlehttp/psr7 has CRLF Injection via URI Host ComponentEPSS 0.2%CVE-2026-84962MEDIUMAuthenticated KMS request forgery via CRLF injection in GCP key identifier stringsEPSS 0.2%CVE-2026-47242MEDIUMNet::IMAP: Command Injection via ID command argumentEPSS 0.2%CVE-2026-55467LOWCUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)EPSS 0.2%CVE-2026-61815HIGHzbateson/mail-mime-parser has CRLF header injection via attachment filenameEPSS 0.2%CVE-2026-48861LOWCRLF injection in HTTP/1 request line via unvalidated method in MintEPSS 0.2%CVE-2026-59919MEDIUMNetty: HAProxy V1 Protocol CRLF Injection via AF_UNIX AddressEPSS 0.2%CVE-2026-61477LOWLibvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injectionEPSS 0.2%CVE-2026-91831LOWSubscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name SettingEPSS 0.2%CVE-2026-43969LOWCookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1EPSS 0.1%CVE-2026-102938MEDIUMvirtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionEPSS 0.1%CVE-2026-118372MEDIUMLibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL PathEPSS 0.1%CVE-2026-118371MEDIUMLibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request LineEPSS 0.1%CVE-2026-102136MEDIUMKiteworks Core Command Execution through Configuration InjectionEPSS 0.1%CVE-2026-109683MEDIUMUPnP Newline Injection Vulnerability in TP-Link Archer BE805EPSS —CVE-2026-123298MEDIUMIn JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possibleEPSS —