Fallos del tipo CWE-297

92 resultados

Divulgação de Informações

Falha que permite que dados sensíveis (credenciais, chaves, PII, tokens) sejam expostos a entidades não autorizadas através de mensagens de erro, logs, respostas HTTP, variáveis de ambiente ou outros mecanismos. O risco está em revelar informações que facilitam ataques subsequentes ou violam privacidade.

Ejemplo

Uma aplicação web retorna stacktrace completo em erro 500, expondo caminhos do servidor, nomes de banco de dados e bibliotecas internas. Ou um endpoint retorna tokens de sessão no histórico de navegação visível. Ou logs com senhas em plain text ficar acessível ao grupo errado.

Cómo mitigar

Nunca exiba detalhes técnicos em respostas de erro (use mensagens genéricas ao cliente); revise logs para remover dados sensíveis; implemente Data Loss Prevention (DLP) nas camadas de saída; valide quem acessa logs, variáveis de ambiente e backups; use criptografia para credenciais em repouso.

CVE-2018-19946MEDIUMThe vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerabilitEPSS 0.3%CVE-2022-29082LOWDell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6EPSS 0.3%CVE-2026-66053MEDIUMApache Thrift: Python TSSLSocket Hostname Matcher ImportEPSS 0.3%CVE-2026-63374CRITICALAnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofingEPSS 0.3%CVE-2026-84393HIGHA improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.EPSS 0.3%CVE-2026-58040MEDIUMAn incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incompEPSS 0.3%CVE-2026-59272MEDIUMLog4j2 AmqpAppender disables TLS hostname verification by defaultEPSS 0.3%CVE-2026-15243HIGHImproper Validation of Certificate in CAS ClientEPSS 0.3%CVE-2022-48306MEDIUMGotham Chat IRC help does not validate hostnames in TLS certificatesEPSS 0.3%CVE-2025-68637CRITICALApache Uniffle: Insecure SSL Configuration in Uniffle HTTP ClientEPSS 0.3%CVE-2026-49457CRITICALQUIC has Broken TLS verificationEPSS 0.2%CVE-2026-22747MEDIUMUnauthorized User Impersonation when Using X.509 Client CertificatesEPSS 0.2%CVE-2026-88647MEDIUMGnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (EPSS 0.2%CVE-2023-34143MEDIUMImproper Validation of Certificate Vulnerability in Hitachi Device ManagerEPSS 0.2%CVE-2026-53583MEDIUMlibgit2: Inverted IP SubjectAltName Comparison in OpenSSL BackendEPSS 0.2%CVE-2026-84975HIGHPJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)EPSS 0.2%CVE-2025-49015MEDIUMThe Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK wEPSS 0.2%CVE-2023-24568MEDIUM Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow replaEPSS 0.2%CVE-2022-27890MEDIUMIt was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactoryEPSS 0.2%CVE-2024-2462MEDIUMAllow attackers to intercept or falsify data exchanges between the client and the serverEPSS 0.2%