Fallos del tipo CWE-297

92 resultados

Divulgação de Informações

Falha que permite que dados sensíveis (credenciais, chaves, PII, tokens) sejam expostos a entidades não autorizadas através de mensagens de erro, logs, respostas HTTP, variáveis de ambiente ou outros mecanismos. O risco está em revelar informações que facilitam ataques subsequentes ou violam privacidade.

Ejemplo

Uma aplicação web retorna stacktrace completo em erro 500, expondo caminhos do servidor, nomes de banco de dados e bibliotecas internas. Ou um endpoint retorna tokens de sessão no histórico de navegação visível. Ou logs com senhas em plain text ficar acessível ao grupo errado.

Cómo mitigar

Nunca exiba detalhes técnicos em respostas de erro (use mensagens genéricas ao cliente); revise logs para remover dados sensíveis; implemente Data Loss Prevention (DLP) nas camadas de saída; valide quem acessa logs, variáveis de ambiente e backups; use criptografia para credenciais em repouso.

CVE-2022-22305MEDIUMAn improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, EPSS 0.5%CVE-2025-3501HIGHOrg.keycloak.protocol.services: keycloak hostname verificationEPSS 0.5%CVE-2026-54275LOWAIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS ConnectionsEPSS 0.5%CVE-2024-32868MEDIUMZITADEL's Improper Lockout Mechanism Leads to MFA BypassEPSS 0.5%CVE-2023-5909HIGHImproper Validation of Certificate with Host Mismatch in PTC KEPServerExEPSS 0.4%CVE-2026-48145HIGHApache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard BypassEPSS 0.4%CVE-2026-12064HIGHproto-default skips SSH verificationEPSS 0.4%CVE-2026-48144CRITICALApache Thrift: c_glib TLS Client Missing Hostname VerificationEPSS 0.4%CVE-2026-92943CRITICALImproper validation of certificate with host mismatch in AWS IoT Device SDK for PythonEPSS 0.4%CVE-2024-8285MEDIUMKroxylicious: missing upstream kafka tls hostname verificationEPSS 0.4%CVE-2024-49782MEDIUMIBM OpenPages improper certificate validationEPSS 0.4%CVE-2024-37015HIGHAn issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establishEPSS 0.4%CVE-2026-9547HIGHSSH improper host validationEPSS 0.4%CVE-2026-107819MEDIUMMariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failureEPSS 0.3%CVE-2026-59638CRITICALJSSE hostname verifier CN-fallback enabled by default despite documented opt-inEPSS 0.3%CVE-2026-42790HIGHnameConstraints DNS bypass via subject CommonName fallback in public_key hostname verificationEPSS 0.3%CVE-2026-84197CRITICALIn Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and oEPSS 0.3%CVE-2024-38324MEDIUMIBM Storage Defender improper certificate validationEPSS 0.3%CVE-2025-2190HIGHThe mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.EPSS 0.3%CVE-2026-59969HIGHApache ZooKeeper: Improper validation of certificate with host mismatch in FIPS modeEPSS 0.3%