Weaknesses of type CWE-93

256 results

Divulgação de Informações

Fraqueza genérica que engloba qualquer falha onde dados sensíveis (credenciais, tokens, caminhos internos, versões de software) são expostos a usuários ou atacantes que não deveriam ter acesso. O risco varia conforme a sensibilidade da informação vazada e o contexto de exposição.

Example

Um aplicativo web mostra mensagens de erro detalhadas contendo stack traces com paths absolutos do servidor, ou um arquivo de configuração versionado no Git expõe chaves de API. Um atacante coleta essas informações para mapear a infraestrutura ou comprometer credenciais.

How to mitigate

Implemente tratamento genérico de erros (sem revelar detalhes técnicos ao usuário final), remova dados sensíveis de logs públicos, revise permissões de arquivo de configuração, use .gitignore para arquivos sensíveis, e estabeleça reviews regulares de what's exposed em respostas HTTP e mensagens de erro.

CVE-2026-119560MEDIUMOPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge FieldsEPSS 0.3%CVE-2026-46720HIGHNet::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-50638CRITICALMetrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2026-71573MEDIUMJoomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2EPSS 0.3%CVE-2025-56007MEDIUMCRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding additional users with fuEPSS 0.3%CVE-2026-9270CRITICALDataDog::DogStatsd versions through 0.07 for Perl allow metric injectionsEPSS 0.3%CVE-2026-3234MEDIUMMod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injectionEPSS 0.3%CVE-2026-46740MEDIUMMojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-74866MEDIUM@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and nameEPSS 0.3%CVE-2026-121946MEDIUMzbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message BuildersEPSS 0.3%CVE-2026-50637HIGHMetrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2025-14531MEDIUMcode-projects Rental Management System Log Transaction.java crlf injectionEPSS 0.3%CVE-2025-67735MEDIUMNetty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoderEPSS 0.3%CVE-2026-41417MEDIUMNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()EPSS 0.3%CVE-2026-84379MEDIUMHTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headersEPSS 0.3%CVE-2024-45302MEDIUMCRLF Injection in RestSharp's `RestRequest.AddHeader` methodEPSS 0.3%CVE-2026-50292HIGHIn libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrEPSS 0.3%CVE-2026-77634HIGHCakePHP: SmtpTransport vulnerable to CRLF header injectionEPSS 0.3%CVE-2026-102471MEDIUMCRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messagesEPSS 0.3%CVE-2024-45597MEDIUMPluto's http.request allows CR and LF in header valuesEPSS 0.3%