Fallos del tipo CWE-294

213 resultados

Exposição de informações sensíveis a atores não autorizados

A aplicação falha em proteger dados sensíveis (credenciais, tokens, chaves, dados pessoais) e os expõe para quem não deveria acessá-los. Isso acontece por falta de controle de acesso, criptografia inadequada ou vazamento em logs/respostas de erro, permitindo que atacantes roubem ou usem esses dados.

Ejemplo

Uma API retorna tokens JWT ou senhas em respostas de erro em texto plano; um arquivo de configuração com credenciais de banco fica acessível via brute force de URLs; logs com dados de clientes são salvos em diretórios públicos do servidor web.

Cómo mitigar

Implemente controle de acesso rigoroso (quem acessa o quê); criptografe dados em trânsito (TLS) e em repouso; remova informações sensíveis de respostas de erro e logs (use IDs genéricos); aplique princípio do menor privilégio em credenciais e secrets.

CVE-2026-73312CRITICALXenForo < 2.3.13 Refresh Token Replay via Expired Access TokenEPSS 0.4%CVE-2026-56453MEDIUMHCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.EPSS 0.4%CVE-2020-35473MEDIUMAn information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.EPSS 0.4%CVE-2026-32987CRITICALOpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device PairingEPSS 0.4%CVE-2026-53424CRITICALMissing one-time-use enforcement in Samly allows replay of SAML bearer assertionsEPSS 0.3%CVE-2024-38284HIGHAuthentication Bypass by Capture-replay in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)EPSS 0.3%CVE-2024-8260MEDIUMOPA SMB Force-AuthenticationEPSS 0.3%CVE-2024-46041HIGHIoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.EPSS 0.3%CVE-2023-39373HIGH Hyundai car CWE-294: Authentication Bypass by Capture-replay EPSS 0.3%CVE-2026-32053MEDIUMOpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID NormalizationEPSS 0.3%CVE-2026-55370MEDIUMLogto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)EPSS 0.3%CVE-2026-41351MEDIUMOpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encodingEPSS 0.3%CVE-2026-35141LOWHCL DFXAnalytics is affected by a Login Replay Attack vulnerabilityEPSS 0.3%CVE-2026-54148HIGHhttp4k: `DigestAuthProvider.verify` did not bind to request URIEPSS 0.3%CVE-2025-35057MEDIUMNewforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashxEPSS 0.3%CVE-2026-69206MEDIUMHttp4s: DigestAuth allows replay of captured requestsEPSS 0.3%CVE-2026-55759HIGHRocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replayEPSS 0.3%CVE-2024-37016MEDIUMMengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach.EPSS 0.3%CVE-2025-8616MEDIUMMalicious browser plugins may cause Authentication replay attack vulnerability to bypass authentication in OpenText Advanced AuthenticationEPSS 0.3%CVE-2026-27855MEDIUMDovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in paEPSS 0.3%