Fallos del tipo CWE-347

766 resultados

Divulgação de informações

Uma fraqueza que permite que dados sensíveis (credenciais, tokens, dados pessoais, detalhes técnicos do sistema) sejam expostos para um atacante ou usuário não autorizado. O risco é alto porque informações divulgadas podem ser usadas para escalar ataques ou comprometer a confidencialidade de dados críticos.

Ejemplo

Um aplicativo web que expõe stack traces com caminhos de arquivo e versões de banco de dados em mensagens de erro HTTP; ou uma API que retorna tokens JWT expirados em respostas de erro em texto plano; ou um arquivo de configuração deixado acessível publicamente contendo credenciais de banco de dados.

Cómo mitigar

Nunca exponha informações técnicas ou sensíveis em mensagens de erro, logs públicos ou respostas da aplicação — use mensagens genéricas para o usuário final. Implemente controle de acesso rigoroso, criptografe dados em repouso e em trânsito, e audite regularmente o que está sendo armazenado e acessível publicamente.

CVE-2025-8454CRITICALIt was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scEPSS 0.3%CVE-2022-31123MEDIUMGrafana plugin signature bypass vulnerabilityEPSS 0.3%CVE-2026-10723MEDIUMIncorrect acceptance of NSEC3 recordsEPSS 0.3%CVE-2026-44714HIGHbitcoinj: ScriptExecution P2PKH/P2WPKH Verification BypassEPSS 0.3%CVE-2026-72861MEDIUMAppwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is AbsentEPSS 0.3%CVE-2026-34840HIGHOneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature VerificationEPSS 0.3%CVE-2023-25934MEDIUM DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. A network attacker with an ability toEPSS 0.3%CVE-2025-71402LOWbetter-auth before 1.4.0 Session Revocation via Forged CookieEPSS 0.3%CVE-2026-36721CRITICALA lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authenticatioEPSS 0.3%CVE-2024-7481HIGHImproper signature verification of Printer driver installation in TeamViewer Remote ClientsEPSS 0.3%CVE-2026-45755MEDIUMSymfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event InjectionEPSS 0.3%CVE-2026-68757HIGHPotential improper SAML signature verification in JFrog ArtifactoryEPSS 0.3%CVE-2026-40941HIGHCacti: Package Import Signature Validation Bypass Allows Self-Signed PackagesEPSS 0.3%CVE-2019-1811MEDIUMCisco NX-OS CLI Command Software Image Signature Verification VulnerabilitiesEPSS 0.3%CVE-2019-1810MEDIUMCisco Nexus 3000 Series and 9000 Series Switches in NX-OS Mode CLI Command Software Image Signature Verification VulnerabilityEPSS 0.3%CVE-2024-23960MEDIUMAlpine Halo9 Improper Verification of Cryptographic Signature VulnerabilityEPSS 0.3%CVE-2026-93998HIGHKeycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerEPSS 0.3%CVE-2026-106078MEDIUMA vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses EPSS 0.3%CVE-2026-67278MEDIUMTLS server impersonation possible in Mikrotik RouterOSEPSS 0.3%CVE-2026-4258HIGHVersions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve vEPSS 0.3%