Fallos del tipo CWE-294

213 resultados

Exposição de informações sensíveis a atores não autorizados

A aplicação falha em proteger dados sensíveis (credenciais, tokens, chaves, dados pessoais) e os expõe para quem não deveria acessá-los. Isso acontece por falta de controle de acesso, criptografia inadequada ou vazamento em logs/respostas de erro, permitindo que atacantes roubem ou usem esses dados.

Ejemplo

Uma API retorna tokens JWT ou senhas em respostas de erro em texto plano; um arquivo de configuração com credenciais de banco fica acessível via brute force de URLs; logs com dados de clientes são salvos em diretórios públicos do servidor web.

Cómo mitigar

Implemente controle de acesso rigoroso (quem acessa o quê); criptografe dados em trânsito (TLS) e em repouso; remova informações sensíveis de respostas de erro e logs (use IDs genéricos); aplique princípio do menor privilégio em credenciais e secrets.

CVE-2026-82470MEDIUMRodauth before 2.47.0 TOTP Code Reuse via Drift WindowEPSS 0.2%CVE-2026-94112HIGHmayswind ezBookkeeping before 2.0.0 TOTP Replay AttackEPSS 0.2%CVE-2026-15614HIGHIdP-initiated SAML sessions not reliably invalidated (replay)EPSS 0.2%CVE-2025-13777HIGHAuthentication Bypass due to Improper Session ValidationEPSS 0.2%CVE-2026-72780HIGHCraft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeyEPSS 0.2%CVE-2023-50128MEDIUMThe remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which EPSS 0.2%CVE-2022-51016MEDIUMPocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login ReplayEPSS 0.2%CVE-2026-46538MEDIUMMicrosoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injectionEPSS 0.2%CVE-2026-41000LOWWSS4J validation does not use configured replay cacheEPSS 0.2%CVE-2026-42602HIGHazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayEPSS 0.2%CVE-2025-6030CRITICALAutoeastern Smart Keyless Entry System Replay AttackEPSS 0.2%CVE-2024-5249MEDIUMSAML Replay in AkanaEPSS 0.2%CVE-2026-2540HIGHMicca KE700 Acceptance of previously used rolling codesEPSS 0.2%CVE-2024-3982HIGHAn attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product andEPSS 0.2%CVE-2024-38890HIGHAn issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attEPSS 0.2%CVE-2024-38272HIGHAuth Bypass in Quick ShareEPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2026-17268MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.2%CVE-2026-75034HIGHRancher: SAML Assertion ReplayEPSS 0.2%CVE-2025-54810HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Authentication Bypass by Capture-replayEPSS 0.2%