Fallos del tipo CWE-538

106 resultados

Exposição de informações sensíveis em arquivos ou diretórios acessíveis externamente

O aplicativo escreve dados sensíveis (senhas, tokens, chaves, dados pessoais) em arquivos ou diretórios que podem ser acessados por usuários não autorizados — seja via web, sistema de arquivos aberto, ou backup público. O risco é que um atacante leia esses arquivos e obtenha credenciais, dados privados ou material para escalar privilégios.

Ejemplo

Um sistema de e-commerce salva recibos com CPF, email e número de cartão (mascarado ou não) em um diretório /tmp/receipts acessível via HTTP; ou um desenvolvedor commita arquivo .env com credenciais de banco de dados no repositório público do GitHub.

Cómo mitigar

Nunca escreva dados sensíveis em arquivos compartilhados, públicos ou versionáveis; use variáveis de ambiente, cofres de secrets (como HashiCorp Vault), ou gestores de credenciais. Se necessário armazenar localmente, restrinja permissões de arquivo (chmod 600), criptografe o conteúdo e não exponha o diretório em URLs acessíveis.

CVE-2026-115711MEDIUMInsertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential DisclosureEPSS 0.2%CVE-2026-67361MEDIUMJoomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.2%CVE-2026-5434MEDIUMImproper storage of sensitive informationEPSS 0.2%CVE-2024-31954HIGHAn issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows. Because it is possible to tamper with the directoEPSS 0.2%CVE-2019-25717MEDIUMDräger Infinity Delta/Kappa Patient Monitors Unauthenticated Log File DisclosureEPSS 0.2%CVE-2025-46820HIGHphpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifactEPSS 0.2%CVE-2025-12699MEDIUMZOLL ePCR IOS Mobile Application Insertion of Sensitive Information into Externally-Accessible File or DirectoryEPSS 0.2%CVE-2026-57442MEDIUMMCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nestedEPSS 0.2%CVE-2026-29114LOWA vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and EPSS 0.2%CVE-2023-38558MEDIUMA vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration ConsoleEPSS 0.2%CVE-2026-50099MEDIUMNaxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directoryEPSS 0.2%CVE-2021-40363—A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versionEPSS 0.2%CVE-2026-25827LOWAn issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what paEPSS 0.2%CVE-2026-27173HIGHApache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line ArgumentsEPSS 0.2%CVE-2025-25586MEDIUMyimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.EPSS 0.2%CVE-2023-5937MEDIUMSensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0EPSS 0.1%CVE-2026-80175LOWDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensEPSS 0.1%CVE-2025-36058MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%CVE-2026-115707MEDIUMInsertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege EscalationEPSS 0.1%CVE-2026-109970MEDIUMClevis: clevis: pkcs#11 token pin written to world-readable fileEPSS 0.1%