Fallos del tipo CWE-297

76 resultados

Divulgação de Informações

Falha que permite que dados sensíveis (credenciais, chaves, PII, tokens) sejam expostos a entidades não autorizadas através de mensagens de erro, logs, respostas HTTP, variáveis de ambiente ou outros mecanismos. O risco está em revelar informações que facilitam ataques subsequentes ou violam privacidade.

Ejemplo

Uma aplicação web retorna stacktrace completo em erro 500, expondo caminhos do servidor, nomes de banco de dados e bibliotecas internas. Ou um endpoint retorna tokens de sessão no histórico de navegação visível. Ou logs com senhas em plain text ficar acessível ao grupo errado.

Cómo mitigar

Nunca exiba detalhes técnicos em respostas de erro (use mensagens genéricas ao cliente); revise logs para remover dados sensíveis; implemente Data Loss Prevention (DLP) nas camadas de saída; valide quem acessa logs, variáveis de ambiente e backups; use criptografia para credenciais em repouso.

CVE-2026-12064HIGHproto-default skips SSH verificationEPSS 0.4%CVE-2024-8285MEDIUMKroxylicious: missing upstream kafka tls hostname verificationEPSS 0.4%CVE-2024-49782MEDIUMIBM OpenPages improper certificate validationEPSS 0.4%CVE-2024-37015HIGHAn issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establishEPSS 0.4%CVE-2026-59969HIGHApache ZooKeeper: Improper validation of certificate with host mismatch in FIPS modeEPSS 0.4%CVE-2024-38324MEDIUMIBM Storage Defender improper certificate validationEPSS 0.3%CVE-2026-42790HIGHnameConstraints DNS bypass via subject CommonName fallback in public_key hostname verificationEPSS 0.3%CVE-2026-65942HIGHApache Ranger: Clients accept TLS certificates issued for other hostnamesEPSS 0.3%CVE-2025-59060MEDIUMApache Ranger: Hostname verification bypass in NiFiRegistryClientEPSS 0.3%CVE-2025-2190HIGHThe mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.EPSS 0.3%CVE-2026-9547HIGHSSH improper host validationEPSS 0.3%CVE-2018-19946MEDIUMThe vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerabilitEPSS 0.3%CVE-2026-22747MEDIUMUnauthorized User Impersonation when Using X.509 Client CertificatesEPSS 0.3%CVE-2022-29082LOWDell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6EPSS 0.3%CVE-2026-15925CRITICALImproper TLS Hostname Verification in Snowflake Connector for PythonEPSS 0.3%CVE-2026-58040MEDIUMAn incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incompEPSS 0.3%CVE-2026-48145HIGHApache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard BypassEPSS 0.3%CVE-2026-92943CRITICALImproper validation of certificate with host mismatch in AWS IoT Device SDK for PythonEPSS 0.3%CVE-2026-54275LOWAIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS ConnectionsEPSS 0.3%CVE-2022-48306MEDIUMGotham Chat IRC help does not validate hostnames in TLS certificatesEPSS 0.3%