Fallos del tipo CWE-1336

302 resultados

Divulgação de Informação

É quando a aplicação expõe dados sensíveis (senhas, tokens, chaves, informações pessoais) a quem não deveria ter acesso. Pode acontecer por erros de configuração, logs inadequados, respostas de erro verbosas ou falta de controle de acesso. O risco é que um atacante ou usuário não autorizado consegue informações que permitem escalar o ataque ou comprometer contas e sistemas.

Ejemplo

Um site de e-commerce que retorna mensagens de erro com stack trace completo contendo caminhos de arquivo e versões de bibliotecas; ou uma API que inclui tokens de sessão em URLs que ficam registradas em logs do servidor web visíveis a outros usuários.

Cómo mitigar

Implemente controle de acesso rigoroso em dados sensíveis, retorne mensagens de erro genéricas para usuários finais (mantendo logs detalhados apenas internamente), remova informações desnecessárias de respostas HTTP, e audite regularmente o que está sendo exposto em logs, comentários de código e configurações.

CVE-2024-48962HIGHApache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)EPSS 0.6%CVE-2026-34172HIGHGiskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 EnvironmentEPSS 0.6%CVE-2026-92196HIGHQuest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution VulnerabilityEPSS 0.6%CVE-2022-4993CRITICALHTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation templateEPSS 0.6%CVE-2024-55660MEDIUMSiYuan has an SSTI via /api/template/renderSprigEPSS 0.6%CVE-2026-11407HIGHPimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowedEPSS 0.6%CVE-2026-77939HIGHFlextype CMS 1.0.0-dev RCE via POST /api/v1/query EndpointEPSS 0.6%CVE-2025-52122CRITICALFreeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitEPSS 0.6%CVE-2026-92592HIGHCraft CMS before 4.18.6 Remote Code Execution via signed cookieEPSS 0.6%CVE-2026-54390CRITICALJTL Shop < 5.7.2 Server-Side Template Injection via Smarty RendererEPSS 0.6%CVE-2025-66437HIGHAn SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This funcEPSS 0.6%CVE-2026-115189HIGHA server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict userEPSS 0.6%CVE-2025-66434HIGHAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The fEPSS 0.6%CVE-2026-28784HIGHCraft is affected by potential authenticated Remote Code Execution via Twig SSTIEPSS 0.6%CVE-2023-41047MEDIUMImproper Neutralization of Special Elements Used in a Template Engine in OctoPrintEPSS 0.6%CVE-2025-64087CRITICALA Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackersEPSS 0.6%CVE-2026-28797HIGHRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentEPSS 0.6%CVE-2026-103537MEDIUMCVE-2026-103537EPSS 0.6%CVE-2023-5764HIGHAnsible: template injectionEPSS 0.6%CVE-2026-9558CRITICALA Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without EPSS 0.6%