Fallos del tipo CWE-347

763 resultados

Divulgação de informações

Uma fraqueza que permite que dados sensíveis (credenciais, tokens, dados pessoais, detalhes técnicos do sistema) sejam expostos para um atacante ou usuário não autorizado. O risco é alto porque informações divulgadas podem ser usadas para escalar ataques ou comprometer a confidencialidade de dados críticos.

Ejemplo

Um aplicativo web que expõe stack traces com caminhos de arquivo e versões de banco de dados em mensagens de erro HTTP; ou uma API que retorna tokens JWT expirados em respostas de erro em texto plano; ou um arquivo de configuração deixado acessível publicamente contendo credenciais de banco de dados.

Cómo mitigar

Nunca exponha informações técnicas ou sensíveis em mensagens de erro, logs públicos ou respostas da aplicação — use mensagens genéricas para o usuário final. Implemente controle de acesso rigoroso, criptografe dados em repouso e em trânsito, e audite regularmente o que está sendo armazenado e acessível publicamente.

CVE-2026-3564CRITICALScreenConnect Instance Level Cryptographic Material ExposureEPSS 0.4%CVE-2026-75939HIGHOpenshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumedEPSS 0.4%CVE-2026-102502MEDIUMCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.4%CVE-2025-20178MEDIUMCisco Secure Network Analytics Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-54773MEDIUMCoreWCF: WS-Security signature substitution via document-wide Signature lookupEPSS 0.4%CVE-2026-65616HIGHPotential privilege escalation to JFrog administrator privilegesEPSS 0.4%CVE-2026-13089HIGHOIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verifyEPSS 0.4%CVE-2023-47122MEDIUMGitsign's Rekor public keys fetched from upstream API instead of local TUF client.EPSS 0.4%CVE-2022-39200HIGHSignature checks not applied to some retrieved missing eventsEPSS 0.4%CVE-2026-54330HIGHCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalationEPSS 0.4%CVE-2026-9027MEDIUMCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST EndpointEPSS 0.4%CVE-2024-11696MEDIUMThe application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flawEPSS 0.4%CVE-2026-4600CRITICALVersions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameEPSS 0.4%CVE-2023-53951CRITICALEver Gauzy v0.281.9 JWT Authentication Weakness via HMAC SecretEPSS 0.4%CVE-2026-107722CRITICALfast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionEPSS 0.4%CVE-2023-25574CRITICALJupyterHub's LTI13Authenticator: JWT signature not validatedEPSS 0.4%CVE-2026-111062LOWA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestEPSS 0.4%CVE-2023-33959HIGHVerification bypass can cause users into verifying the wrong artifactEPSS 0.4%CVE-2023-41037MEDIUMCleartext Signed Message Signature Spoofing in openpgpjsEPSS 0.4%CVE-2024-37532HIGHIBM WebSphere Application Server identity spoofingEPSS 0.4%