Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2026-59313CRITICALServer Sent Event stream corruption in Spring MVC functional web frameworkEPSS 0.6%CVE-2026-47890CRITICALSpring Framework Server Sent Event stream corruption while rendering fragmentsEPSS 0.6%CVE-2023-0040HIGHVersions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerabEPSS 0.6%CVE-2026-1502MEDIUMHTTP client proxy tunnel headers not validated for CR/LFEPSS 0.6%CVE-2024-51501CRITICALCRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributesEPSS 0.6%CVE-2026-35519HIGHPi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline InjectionEPSS 0.5%CVE-2026-47072MEDIUMCRLF injection in WebSocket upgrade request in hackneyEPSS 0.5%CVE-2025-15282MEDIUMHeader injection via newlines in data URL mediatypeEPSS 0.5%CVE-2026-50269LOWAIOHTTP: CRLF injection in multipart headersEPSS 0.5%CVE-2026-53533MEDIUMaiosmtplib: SMTP command injection via CR/LF in sender/recipient addressEPSS 0.5%CVE-2026-39394HIGHCI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install ControllerEPSS 0.5%CVE-2026-77549CRITICALA malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulneraEPSS 0.5%CVE-2026-48019HIGHCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relayEPSS 0.5%CVE-2024-53693HIGHQTS, QuTS heroEPSS 0.5%CVE-2026-123095HIGHmpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook NewlinesEPSS 0.5%CVE-2026-40530HIGHAn improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1EPSS 0.5%CVE-2026-23953HIGHIncus container environment configuration newline injectionEPSS 0.5%CVE-2024-48867MEDIUMQTS, QuTS heroEPSS 0.5%CVE-2023-34472MEDIUMAMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A succEPSS 0.5%CVE-2026-5140HIGHAuthorization Bypass in TUBITAK BILGEM's Pardus UpdateEPSS 0.5%