Fallos del tipo CWE-347

641 resultados

Divulgação de informações

Uma fraqueza que permite que dados sensíveis (credenciais, tokens, dados pessoais, detalhes técnicos do sistema) sejam expostos para um atacante ou usuário não autorizado. O risco é alto porque informações divulgadas podem ser usadas para escalar ataques ou comprometer a confidencialidade de dados críticos.

Ejemplo

Um aplicativo web que expõe stack traces com caminhos de arquivo e versões de banco de dados em mensagens de erro HTTP; ou uma API que retorna tokens JWT expirados em respostas de erro em texto plano; ou um arquivo de configuração deixado acessível publicamente contendo credenciais de banco de dados.

Cómo mitigar

Nunca exponha informações técnicas ou sensíveis em mensagens de erro, logs públicos ou respostas da aplicação — use mensagens genéricas para o usuário final. Implemente controle de acesso rigoroso, criptografe dados em repouso e em trânsito, e audite regularmente o que está sendo armazenado e acessível publicamente.

CVE-2026-53501HIGHThumbor has HMAC validation bypass via multiple .replace() calls when removing URL signatureEPSS 0.2%CVE-2020-3138—Cisco Enterprise NFV Infrastructure Software Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-44720MEDIUMOpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account TakeoverEPSS 0.2%CVE-2026-5050HIGHPayment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status ManipulationEPSS 0.2%CVE-2026-31946CRITICALOpenOLAT: Authentication bypass via forged JWT in OIDC implicit flowEPSS 0.2%CVE-2026-69646HIGHSkype for Business Spoofing VulnerabilityEPSS 0.2%CVE-2025-71402LOWbetter-auth before 1.4.0 Session Revocation via Forged CookieEPSS 0.2%CVE-2025-2763MEDIUMCarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution VulnerabilityEPSS 0.2%CVE-2026-34872CRITICALAn issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH duEPSS 0.2%CVE-2021-1244MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2022-42793MEDIUMAn issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 1EPSS 0.2%CVE-2021-1136MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2026-54774HIGHCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateEPSS 0.2%CVE-2025-55311MEDIUMAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript tEPSS 0.2%CVE-2025-12150LOWOrg.keycloak/keycloak-services: webauthn attestation statement verification bypassEPSS 0.2%CVE-2026-74876CRITICALopenssl_encrypt before 1.4.0 Unverified Key Bundle EncryptionEPSS 0.2%CVE-2026-34068MEDIUMnimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledgeEPSS 0.2%CVE-2026-72861MEDIUMAppwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is AbsentEPSS 0.2%CVE-2026-32144HIGHOCSP designated-responder authorization bypass via missing signature verificationEPSS 0.2%CVE-2026-28198CRITICALPrivilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS ShellEPSS 0.2%