Weaknesses of type CWE-93

251 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2024-50405MEDIUMQTS, QuTS heroEPSS 0.4%CVE-2026-45125MEDIUMMyBB: Email User CRLF injectionEPSS 0.4%CVE-2026-57511MEDIUMSuperPlane < 0.30.0 SMTP Header Injection via Webhook Event TitleEPSS 0.4%CVE-2026-21428HIGHcpp-httplib has CRLF injection in http headersEPSS 0.4%CVE-2025-48388HIGHFreeScout Has Insufficient Protection Against CRLF-injectionEPSS 0.4%CVE-2026-24489MEDIUMGakido vulnerable to HTTP Header Injection (CRLF Injection)EPSS 0.4%CVE-2026-71311MEDIUMrclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves NewlinesEPSS 0.4%CVE-2026-45070MEDIUMSymfony: Email Header Injection via Non-Token Characters in Mime Parameter NamesEPSS 0.4%CVE-2026-1467MEDIUMLibsoup: libsoup: http header injection via specially crafted urls when an http proxy is configuredEPSS 0.4%CVE-2026-119415MEDIUMCakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-TypeEPSS 0.4%CVE-2026-20113MEDIUMA vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauEPSS 0.4%CVE-2026-39958MEDIUMoma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF InjectionEPSS 0.4%CVE-2026-41504MEDIUMOWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsEPSS 0.4%CVE-2026-116237CRITICALOray Pugongying X5 Pro Dnsmasq crlf injectionEPSS 0.4%CVE-2026-70615HIGHboringproxy 0.10.0 SSH authorized_keys Injection via Tunnel CreationEPSS 0.4%CVE-2026-0673MEDIUMElement Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header InjectionEPSS 0.4%CVE-2026-16313HIGHSg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --exportEPSS 0.3%CVE-2026-41230HIGHFroxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()EPSS 0.3%CVE-2026-1536MEDIUMLibsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition headerEPSS 0.3%CVE-2026-119560MEDIUMOPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge FieldsEPSS 0.3%