Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2026-0672MEDIUMHeader injection in http.cookies.MorselEPSS 0.5%CVE-2026-44217MEDIUMsse-channel: SSE Injection via unsanitized event fieldsEPSS 0.5%CVE-2026-47075MEDIUMCR/LF injection in query parameter in hackneyEPSS 0.5%CVE-2026-54511HIGH@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keysEPSS 0.5%CVE-2025-8715HIGHPostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target serverEPSS 0.5%CVE-2026-2717MEDIUMHTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header ValuesEPSS 0.5%CVE-2026-59921MEDIUMNetty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderEPSS 0.5%CVE-2026-116234CRITICALOray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injectionEPSS 0.5%CVE-2026-116233CRITICALOray Pugongying X5 Pro Dnsmasq crlf injectionEPSS 0.5%CVE-2026-77341MEDIUMcpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writingEPSS 0.5%CVE-2026-57154HIGHOPNsense: Configuration line injection via multiple GUI text fieldsEPSS 0.5%CVE-2024-7472MEDIUMEmail Injection Vulnerability in lunary-ai/lunaryEPSS 0.5%CVE-2026-119417MEDIUMCakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransportEPSS 0.5%CVE-2026-90937CRITICALfroxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLEPSS 0.5%CVE-2024-1226HIGHMultiple vulnerabilities in Rejetto's Http File ServerEPSS 0.4%CVE-2026-94216MEDIUMST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splittingEPSS 0.4%CVE-2026-11362CRITICALDataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tagsEPSS 0.4%CVE-2026-50188MEDIUMKirby: Request header injection in `Http\Remote`EPSS 0.4%CVE-2025-28357HIGHA CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTPEPSS 0.4%CVE-2023-26148MEDIUMAll versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attaEPSS 0.4%