Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2023-26148MEDIUMAll versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attaEPSS 0.4%CVE-2025-40671CRITICALSQL injection vulnerability in AES Multimedia's GestnetEPSS 0.4%CVE-2024-48868HIGHQTS, QuTS heroEPSS 0.4%CVE-2026-50629MEDIUMApache CXF: OAuth2: Log Injection via Unsanitized Client IdentifierEPSS 0.4%CVE-2026-116232CRITICALOray Pugongying X5 Pro SNMP snmp_set crlf injectionEPSS 0.4%CVE-2025-59151HIGHPi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injectionEPSS 0.4%CVE-2026-116231CRITICALOray Pugongying X5 Pro Ser2net crlf injectionEPSS 0.4%CVE-2026-90767HIGHFroxlor before 2.3.12 SSH Key Injection via authorized_keysEPSS 0.4%CVE-2025-52479HIGHHTTP.jl vulnerable to CR/LF Injection in URIsEPSS 0.4%CVE-2025-53094HIGHESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cppEPSS 0.4%CVE-2026-42257MEDIUMnet-imap: Command Injection via "raw" arguments to multiple commandsEPSS 0.4%CVE-2026-47069LOWCRLF injection in cookie domain/path options in hackneyEPSS 0.4%CVE-2023-26138MEDIUMAll versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headersEPSS 0.4%CVE-2026-119424MEDIUMOPNsense before 26.7.8 Wireless WPA Configuration Line Injection via IdentityEPSS 0.4%CVE-2026-28296MEDIUMGvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file pathsEPSS 0.4%CVE-2026-90990MEDIUMLivestatus injection via monitoring filter valuesEPSS 0.4%CVE-2024-36459HIGHCross-Site Scripting Vulnerability in Symantec SiteMinder Web AgentEPSS 0.4%CVE-2026-82973CRITICALImproper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailboxEPSS 0.4%CVE-2026-75922MEDIUMReverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request lineEPSS 0.4%CVE-2026-59920MEDIUMNetty: STOMP CONNECT Frame Header InjectionEPSS 0.4%