Fallos del tipo CWE-347

766 resultados

Divulgação de informações

Uma fraqueza que permite que dados sensíveis (credenciais, tokens, dados pessoais, detalhes técnicos do sistema) sejam expostos para um atacante ou usuário não autorizado. O risco é alto porque informações divulgadas podem ser usadas para escalar ataques ou comprometer a confidencialidade de dados críticos.

Ejemplo

Um aplicativo web que expõe stack traces com caminhos de arquivo e versões de banco de dados em mensagens de erro HTTP; ou uma API que retorna tokens JWT expirados em respostas de erro em texto plano; ou um arquivo de configuração deixado acessível publicamente contendo credenciais de banco de dados.

Cómo mitigar

Nunca exponha informações técnicas ou sensíveis em mensagens de erro, logs públicos ou respostas da aplicação — use mensagens genéricas para o usuário final. Implemente controle de acesso rigoroso, criptografe dados em repouso e em trânsito, e audite regularmente o que está sendo armazenado e acessível publicamente.

CVE-2020-3138—Cisco Enterprise NFV Infrastructure Software Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-15598MEDIUMDataease SQLBot JWT Token auth.py validateEmbedded signature verificationEPSS 0.2%CVE-2026-34872CRITICALAn issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH duEPSS 0.2%CVE-2026-61855MEDIUMZammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound MailEPSS 0.2%CVE-2026-44720MEDIUMOpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account TakeoverEPSS 0.2%CVE-2021-1244MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2021-1136MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2026-32144HIGHOCSP designated-responder authorization bypass via missing signature verificationEPSS 0.2%CVE-2026-94212MEDIUMApache APISIX: unauthenticated impersonation issue in saml-authEPSS 0.2%CVE-2025-2763MEDIUMCarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution VulnerabilityEPSS 0.2%CVE-2026-22696CRITICALdcap-qvl has Missing Verification for QE IdentityEPSS 0.2%CVE-2025-4371HIGHA potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical acceEPSS 0.2%CVE-2026-104435HIGHZebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without OutputEPSS 0.2%CVE-2026-119561HIGHphpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServerEPSS 0.2%CVE-2026-68745HIGHApache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdPEPSS 0.2%CVE-2026-81680CRITICALopenssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot RemovalEPSS 0.2%CVE-2025-55039MEDIUMApache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksEPSS 0.2%CVE-2026-54774HIGHCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateEPSS 0.2%CVE-2025-55311MEDIUMAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript tEPSS 0.2%CVE-2026-22866LOWENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding ValidationEPSS 0.2%