Fallos del tipo CWE-668

252 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, dados pessoais, internals do sistema) através de canais ou comportamentos não pretendidos. O risco é que um atacante ou usuário não autorizado acesse informações que deveria estar protegidas, comprometendo confidencialidade.

Ejemplo

Uma API retorna stack traces completos em erros HTTP, revelando caminhos internos do servidor e bibliotecas usadas. Um atacante captura essa resposta e usa as informações para identificar versões vulneráveis e planejar exploits mais direcionados.

Cómo mitigar

Implemente tratamento de erros genérico (nunca exponha detalhes técnicos ao usuário final), use logging seguro para diagnóstico interno, aplique princípio do menor privilégio em acesso a dados, e realize auditorias regulares de o que sua aplicação expõe em respostas, logs e comentários de código.

CVE-2026-72782HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Environment Variable LeakEPSS 0.4%CVE-2026-26057MEDIUMSkill Scanner Unsecured Network Binding VulnerabilityEPSS 0.4%CVE-2026-47141MEDIUMvm2: NodeVM observability builtins leak host process and HTTP request dataEPSS 0.4%CVE-2025-8107MEDIUMIn OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executiEPSS 0.4%CVE-2026-115522MEDIUMCross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for PythonEPSS 0.4%CVE-2024-21597MEDIUMJunos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filtersEPSS 0.4%CVE-2025-21608MEDIUMForged packets over MQTT can show up in direct messages in Meshtastic firmwareEPSS 0.4%CVE-2020-16212—Philips Patient Monitoring Devices Exposure of Resource to Wrong SphereEPSS 0.4%CVE-2022-45935MEDIUMApache James server: Temporary File Information DisclosureEPSS 0.4%CVE-2024-5313MEDIUMCWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This doEPSS 0.4%CVE-2026-104073MEDIUMNetBox 2.9.5 < 4.7.0 Session Hijacking via Custom LinksEPSS 0.4%CVE-2025-25176CRITICALGPU DDK - GPU Register value contents leaked from secure workloads to non-secure worldEPSS 0.4%CVE-2026-61590HIGHdjust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUGEPSS 0.4%CVE-2021-39212MEDIUMIssue when Configuring the ImageMagick Security PolicyEPSS 0.4%CVE-2024-32473MEDIUMMoby IPv6 enabled on IPv4-only network interfacesEPSS 0.4%CVE-2026-82650MEDIUMSiYuan before v3.8.1 Path Traversal via /api/template/renderEPSS 0.4%CVE-2024-24562MEDIUMSecurity headers not set in vantage6-UIEPSS 0.3%CVE-2026-8958HIGHInformation disclosure, sandbox escape in the Security: Process Sandboxing componentEPSS 0.3%CVE-2023-25954MEDIUMKYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 EPSS 0.3%CVE-2026-82652MEDIUMSiYuan before v3.8.1 Information Disclosure via Publish AccessEPSS 0.3%