Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2026-35520HIGHPi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline InjectionEPSS 0.7%CVE-2026-75484MEDIUMHTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in BanditEPSS 0.7%CVE-2024-40324CRITICALA CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fielEPSS 0.7%CVE-2026-44092HIGHMissing input validation / stripping of CRLF characters in SystemConfigManagerEPSS 0.7%CVE-2024-32986CRITICALArbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox EPSS 0.7%CVE-2026-75925CRITICALIXON VPN Client CRLF InjectionEPSS 0.7%CVE-2026-12143HIGHform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)EPSS 0.7%CVE-2024-5193MEDIUMRitlabs TinyWeb Server Request crlf injectionEPSS 0.7%CVE-2026-55159HIGHluci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entriesEPSS 0.7%CVE-2026-90819MEDIUMa2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splittingEPSS 0.7%CVE-2025-11468MEDIUMFolding email comments of unfoldable characters doesn't preserve parenthesisEPSS 0.6%CVE-2026-116235CRITICALOray Pugongying X5 Pro L2TP Authentication crlf injectionEPSS 0.6%CVE-2026-45067MEDIUMSymfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\AddressEPSS 0.6%CVE-2026-33128HIGHh3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream FieldsEPSS 0.6%CVE-2025-41376MEDIUMCRLF Injection in LimesurveyEPSS 0.6%CVE-2026-12127MEDIUMWPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display NameEPSS 0.6%CVE-2026-6351HIGHOpenfind｜MailGates/MailAudit - CRLF InjectionEPSS 0.6%CVE-2025-8419MEDIUMOrg.keycloak/keycloak-services: keycloak smtp inject vulnerabilityEPSS 0.6%CVE-2026-1299MEDIUMemail BytesGenerator header injection due to unquoted newlinesEPSS 0.6%CVE-2026-11373CRITICALNet::Statsite::Client versions through 1.1.0 for Perl allow metric injectionsEPSS 0.6%