Fallos del tipo CWE-294

240 resultados

Exposição de informações sensíveis a atores não autorizados

A aplicação falha em proteger dados sensíveis (credenciais, tokens, chaves, dados pessoais) e os expõe para quem não deveria acessá-los. Isso acontece por falta de controle de acesso, criptografia inadequada ou vazamento em logs/respostas de erro, permitindo que atacantes roubem ou usem esses dados.

Ejemplo

Uma API retorna tokens JWT ou senhas em respostas de erro em texto plano; um arquivo de configuração com credenciais de banco fica acessível via brute force de URLs; logs com dados de clientes são salvos em diretórios públicos do servidor web.

Cómo mitigar

Implemente controle de acesso rigoroso (quem acessa o quê); criptografe dados em trânsito (TLS) e em repouso; remova informações sensíveis de respostas de erro e logs (use IDs genéricos); aplique princípio do menor privilégio em credenciais e secrets.

CVE-2025-6029CRITICALKIA-branded Aftermarket Generic Smart Keyless Entry System Replay AttackEPSS 0.7%CVE-2026-68079CRITICALApache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replayEPSS 0.7%CVE-2026-28564CRITICALApache IoTDB: REST Basic Authentication Accepts Stale Cached CredentialsEPSS 0.7%CVE-2018-17935—All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. ThisEPSS 0.7%CVE-2024-38438CRITICALD-Link - CWE-294: Authentication Bypass by Capture-replayEPSS 0.7%CVE-2024-29901MEDIUM@workos-inc/authkit-nextjs session replay vulnerabilityEPSS 0.7%CVE-2023-39547—CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleEPSS 0.6%CVE-2023-47435CRITICALAn issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected EPSS 0.6%CVE-2022-2780HIGHIn affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB requesEPSS 0.6%CVE-2022-29475MEDIUMAn information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9EPSS 0.6%CVE-2024-40715HIGHA vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypasEPSS 0.6%CVE-2026-53424CRITICALMissing one-time-use enforcement in Samly allows replay of SAML bearer assertionsEPSS 0.6%CVE-2021-38827HIGHXiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.EPSS 0.6%CVE-2026-84003HIGHMicrosoft Authentication Library (MSAL) for Node.js Spoofing VulnerabilityEPSS 0.6%CVE-2026-67581HIGHOn-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replayEPSS 0.6%CVE-2026-73136HIGHStatic memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replayEPSS 0.6%CVE-2024-45244MEDIUMHyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.EPSS 0.6%CVE-2025-26201CRITICALCredential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentEPSS 0.6%CVE-2023-29158MEDIUMSUBNET PowerSYSTEM Center Authentication Bypass by Capture-replayEPSS 0.6%CVE-2026-54148HIGHhttp4k: `DigestAuthProvider.verify` did not bind to request URIEPSS 0.6%