Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2026-57281HIGHJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions mEPSS 0.9%CVE-2020-3246MEDIUMCisco Umbrella Carriage Return Line Feed Injection VulnerabilityEPSS 0.9%CVE-2026-35517HIGHPi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline InjectionEPSS 0.9%CVE-2021-4097MEDIUMCRLF Injection in phpservermon/phpservermonEPSS 0.9%CVE-2026-111219HIGHNetgate pfSense CE through 2.9.0 Command Injection via PPPoE Server UsernameEPSS 0.9%CVE-2026-22777HIGHComfyUI-Manager is Vulnerable to CRLF Injection in Configuration HandlerEPSS 0.9%CVE-2020-15111MEDIUMCRLF vulnerability in FiberEPSS 0.9%CVE-2026-47240MEDIUMNet::IMAP: Command Injection via non-synchronizing literal in "raw" argumentEPSS 0.8%CVE-2026-77550CRITICALA malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devicEPSS 0.8%CVE-2026-114720HIGHRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attackEPSS 0.8%CVE-2026-42258MEDIUMnet-imap: Command Injection via unvalidated Symbol inputsEPSS 0.8%CVE-2019-15616—Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.EPSS 0.8%CVE-2025-27111MEDIUMEscape Sequence Injection vulnerability in Rack lead to Possible Log InjectionEPSS 0.8%CVE-2026-115785MEDIUMZimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressEPSS 0.7%CVE-2026-1714HIGHShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX ActionEPSS 0.7%CVE-2026-113403HIGHArmorX Global Technology｜ArmorX Spam - Command InjectionEPSS 0.7%CVE-2026-111220HIGHNetgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpidEPSS 0.7%CVE-2026-84372CRITICALPredis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connectionsEPSS 0.7%CVE-2026-35521HIGHPi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline InjectionEPSS 0.7%CVE-2026-35520HIGHPi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline InjectionEPSS 0.7%