Fallos del tipo CWE-668

253 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, dados pessoais, internals do sistema) através de canais ou comportamentos não pretendidos. O risco é que um atacante ou usuário não autorizado acesse informações que deveria estar protegidas, comprometendo confidencialidade.

Ejemplo

Uma API retorna stack traces completos em erros HTTP, revelando caminhos internos do servidor e bibliotecas usadas. Um atacante captura essa resposta e usa as informações para identificar versões vulneráveis e planejar exploits mais direcionados.

Cómo mitigar

Implemente tratamento de erros genérico (nunca exponha detalhes técnicos ao usuário final), use logging seguro para diagnóstico interno, aplique princípio do menor privilégio em acesso a dados, e realize auditorias regulares de o que sua aplicação expõe em respostas, logs e comentários de código.

CVE-2021-1438MEDIUMCisco Wide Area Application Services Software Information Disclosure VulnerabilityEPSS 0.2%CVE-2026-42875MEDIUMExternal Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStoreEPSS 0.2%CVE-2026-79031LOWImproper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a craftEPSS 0.2%CVE-2021-1423MEDIUMCisco Aironet Access Points Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2026-41368HIGHOpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter BypassEPSS 0.2%CVE-2024-35183MEDIUMwolfictl leaks GitHub tokens to remote non-GitHub git serversEPSS 0.2%CVE-2026-112936MEDIUMfilelock: ReadWriteLock follows a symlink at the lock path into SQLiteEPSS 0.2%CVE-2025-55077MEDIUMTyler Technologies ERP Pro 9 SaaS application escapeEPSS 0.2%CVE-2025-12351MEDIUMInadequate access control measure allows unauthorized users to access restricted administrative functionsEPSS 0.2%CVE-2024-13484HIGHOpenshift-gitops-operator-container: namespace isolation breakEPSS 0.2%CVE-2026-59308MEDIUMSemantic Cache Cross-Tenant Isolation Bypass via SHA-256 TruncationEPSS 0.2%CVE-2023-4910MEDIUM3scale-admin-portal: logged out users tokens can be accessedEPSS 0.2%CVE-2026-105746LOWDocling: KServe v2 OCR engine does not enforce enable_remote_servicesEPSS 0.2%CVE-2026-2297MEDIUMSourcelessFileLoader does not use io.open_code()EPSS 0.2%CVE-2026-106354MEDIUMImproper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via aEPSS 0.2%CVE-2026-102262HIGHNewell Brands DYMO ID parent directory open to path traversal through improper spheres of controlEPSS 0.2%CVE-2026-57144HIGHPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableEPSS 0.2%CVE-2022-46756HIGH Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploiEPSS 0.2%CVE-2023-3670HIGHCodesys: Vulnerability in CODESYS Development System and CODESYS ScriptingEPSS 0.2%CVE-2026-53657HIGHLima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socketEPSS 0.2%