Fallos del tipo CWE-41

42 resultados

Divulgação de Informações

É quando a aplicação expõe dados sensíveis (credenciais, tokens, dados pessoais, caminhos internos) para um atacante que não deveria ter acesso. Pode ocorrer através de mensagens de erro verbosas, comentários no código enviado ao cliente, variáveis de ambiente expostas, ou logs acessíveis.

Ejemplo

Uma página de erro que mostra a stack trace completa da aplicação com caminho do servidor, versão do banco de dados e nomes de tabelas; ou um arquivo .env commited no repositório público que contém chaves API e senhas de banco de dados.

Cómo mitigar

Implemente tratamento genérico de erros (nunca exponha detalhes técnicos ao usuário), revise logs e mensagens de debug, audite credenciais em repositórios com ferramentas como git-secrets, e aplique princípio do menor privilégio para acesso a informações do sistema.

CVE-2026-73019MEDIUMWindows URL Moniker Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2024-6839MEDIUMImproper Regex Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2023-46169MEDIUMIBM DS8900F file manipulationEPSS 0.5%CVE-2026-72835HIGHfilebrowser before v2.63.21 Access Rule Bypass via Path CanonicalizationEPSS 0.5%CVE-2026-112343HIGHSyncplify Server! < 8.8.0 Permission Override Bypass via Path CasingEPSS 0.5%CVE-2026-93709MEDIUMDancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handlerEPSS 0.5%CVE-2026-66064MEDIUMgoshs has ACL Bypass & Path TraversalEPSS 0.4%CVE-2026-70184HIGHWindows Backup Engine Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-5816HIGHImproper Resolution of Path Equivalence in GitLabEPSS 0.4%CVE-2026-102231HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-34451MEDIUMClaude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling DirectoriesEPSS 0.4%CVE-2026-119200MEDIUMNuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesEPSS 0.3%CVE-2026-34510MEDIUMOpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media LoadersEPSS 0.3%CVE-2026-110725LOWfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesEPSS 0.3%CVE-2026-110095LOWfast-uri vulnerable to improper path equivalence in relative reference normalizationEPSS 0.3%CVE-2024-45405MEDIUMgix-path improperly resolves configuration path reported by GitEPSS 0.3%CVE-2025-43298HIGHA parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, mEPSS 0.2%CVE-2026-57441HIGHMCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalenceEPSS 0.2%CVE-2026-49401HIGHDeno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)EPSS 0.2%CVE-2025-0115MEDIUMPAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLIEPSS 0.2%