Fallos del tipo CWE-297

92 resultados

Divulgação de Informações

Falha que permite que dados sensíveis (credenciais, chaves, PII, tokens) sejam expostos a entidades não autorizadas através de mensagens de erro, logs, respostas HTTP, variáveis de ambiente ou outros mecanismos. O risco está em revelar informações que facilitam ataques subsequentes ou violam privacidade.

Ejemplo

Uma aplicação web retorna stacktrace completo em erro 500, expondo caminhos do servidor, nomes de banco de dados e bibliotecas internas. Ou um endpoint retorna tokens de sessão no histórico de navegação visível. Ou logs com senhas em plain text ficar acessível ao grupo errado.

Cómo mitigar

Nunca exiba detalhes técnicos em respostas de erro (use mensagens genéricas ao cliente); revise logs para remover dados sensíveis; implemente Data Loss Prevention (DLP) nas camadas de saída; valide quem acessa logs, variáveis de ambiente e backups; use criptografia para credenciais em repouso.

CVE-2026-91166MEDIUMWarpgate: Web SSH stores a jump host's key against the target's address, so it validates as the targetEPSS 0.2%CVE-2026-26214CRITICALXiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITMEPSS 0.2%CVE-2022-48307MEDIUMIt was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactorEPSS 0.2%CVE-2026-66392MEDIUMApache bRPC: TLS Client Accepts Certificates for Mismatched Peer NamesEPSS 0.2%CVE-2026-79636HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper ValidatiEPSS 0.2%CVE-2025-42921MEDIUMIn JetBrains Toolbox App before 2.6 host key verification was missing in SSH pluginEPSS 0.2%CVE-2026-107938CRITICALApache CXF: The Netty HTTP client transport does not perform TLS hostname verification.EPSS 0.2%CVE-2022-48308MEDIUMIt was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactoryEPSS 0.2%CVE-2026-117666CRITICALssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundaryEPSS 0.2%CVE-2026-102669MEDIUMJoyland AI hostname checking disabledEPSS 0.2%CVE-2026-35563HIGHApache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostnameEPSS 0.2%CVE-2026-9744MEDIUMVulnerabilities exists in IBM Netezza SoftwareEPSS 0.2%CVE-2026-15925CRITICALImproper TLS Hostname Verification in Snowflake Connector for PythonEPSS 0.2%CVE-2026-109408HIGHvault-java-driver: SslConfig silently disables requested TLS verificationEPSS 0.2%CVE-2026-44393HIGHAn issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname vEPSS 0.2%CVE-2024-54019MEDIUMA improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 EPSS 0.2%CVE-2026-85088MEDIUMApache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not matchEPSS 0.2%CVE-2026-12730LOWImproper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containersEPSS 0.2%CVE-2024-7346HIGHClient connections using default TLS certificates from OpenEdge may bypass TLS host name validationEPSS 0.2%CVE-2026-91769MEDIUMTLS Hostname Verification Falls Back to CN After SAN MismatchEPSS 0.2%