Fallos del tipo CWE-668

236 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, dados pessoais, internals do sistema) através de canais ou comportamentos não pretendidos. O risco é que um atacante ou usuário não autorizado acesse informações que deveria estar protegidas, comprometendo confidencialidade.

Ejemplo

Uma API retorna stack traces completos em erros HTTP, revelando caminhos internos do servidor e bibliotecas usadas. Um atacante captura essa resposta e usa as informações para identificar versões vulneráveis e planejar exploits mais direcionados.

Cómo mitigar

Implemente tratamento de erros genérico (nunca exponha detalhes técnicos ao usuário final), use logging seguro para diagnóstico interno, aplique princípio do menor privilégio em acesso a dados, e realize auditorias regulares de o que sua aplicação expõe em respostas, logs e comentários de código.

CVE-2023-49344MEDIUMTemporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. TheEPSS 0.3%CVE-2023-49345MEDIUMTemporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2019-12660MEDIUMCisco IOS XE Software ASIC Register Write VulnerabilityEPSS 0.3%CVE-2021-41988HIGHQlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.EPSS 0.3%CVE-2021-41989HIGHQlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions.EPSS 0.3%CVE-2026-34765MEDIUMElectron named window.open targets not scoped to the opener's browsing contextEPSS 0.3%CVE-2026-33573HIGHOpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC ParametersEPSS 0.3%CVE-2025-49574MEDIUMQuarkus potential data leak when duplicating a duplicated contextEPSS 0.3%CVE-2024-21605HIGHJunos OS: SRX 300 Series: Specific link local traffic causes a control plane overloadEPSS 0.3%CVE-2026-85053HIGHImproper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insidEPSS 0.3%CVE-2026-34217MEDIUMSandboxJS has a Sandbox Escape via Prop Object Leak in New HandlerEPSS 0.3%CVE-2024-42350LOWPublic key confusion in third party block in BiscuitEPSS 0.3%CVE-2026-73843CRITICALOpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsEPSS 0.3%CVE-2026-50202MEDIUMSteeltoe's static JWKS cache shared across schemes and never invalidatedEPSS 0.3%CVE-2026-35658MEDIUMOpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image ToolEPSS 0.3%CVE-2025-6788MEDIUMA CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providEPSS 0.3%CVE-2021-33096MEDIUMImproper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticateEPSS 0.3%CVE-2026-41362LOWOpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared AuthenticationEPSS 0.3%CVE-2025-3651CRITICALCommand Injection in iManage Work Desktop for Mac's Agent ServiceEPSS 0.3%CVE-2022-22732LOWA CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) suppEPSS 0.3%