Fallos del tipo CWE-668

252 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, chaves, dados pessoais, internals do sistema) através de canais ou comportamentos não pretendidos. O risco é que um atacante ou usuário não autorizado acesse informações que deveria estar protegidas, comprometendo confidencialidade.

Ejemplo

Uma API retorna stack traces completos em erros HTTP, revelando caminhos internos do servidor e bibliotecas usadas. Um atacante captura essa resposta e usa as informações para identificar versões vulneráveis e planejar exploits mais direcionados.

Cómo mitigar

Implemente tratamento de erros genérico (nunca exponha detalhes técnicos ao usuário final), use logging seguro para diagnóstico interno, aplique princípio do menor privilégio em acesso a dados, e realize auditorias regulares de o que sua aplicação expõe em respostas, logs e comentários de código.

CVE-2026-34780HIGHElectron: Context Isolation bypass via contextBridge VideoFrame transferEPSS 0.3%CVE-2026-54497MEDIUMview_component: Reused Component Instances Retain Stale Render ContextEPSS 0.3%CVE-2020-12020—Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative EPSS 0.3%CVE-2025-6788MEDIUMA CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providEPSS 0.3%CVE-2025-32783MEDIUMXWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wikiEPSS 0.3%CVE-2024-29905HIGHDIRAC: Unauthorized users can read proxy contents during generationEPSS 0.3%CVE-2026-46723MEDIUMInformation Disclosure in extension "Faceted Search" (ke_search)EPSS 0.3%CVE-2023-49342MEDIUMTemporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2019-3682HIGHInsecure API port exposed to all Master Node guest containersEPSS 0.3%CVE-2026-41369HIGHOpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host ExecutionEPSS 0.3%CVE-2023-49347MEDIUMTemporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data EPSS 0.3%CVE-2026-54495MEDIUMCross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clustersEPSS 0.3%CVE-2026-44552HIGHOpen WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache PoisoningEPSS 0.3%CVE-2026-34217MEDIUMSandboxJS has a Sandbox Escape via Prop Object Leak in New HandlerEPSS 0.3%CVE-2023-49346MEDIUMTemporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The datEPSS 0.3%CVE-2023-49345MEDIUMTemporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2023-49344MEDIUMTemporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. TheEPSS 0.3%CVE-2023-49343MEDIUMTemporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is EPSS 0.3%CVE-2026-33573HIGHOpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC ParametersEPSS 0.3%CVE-2019-12660MEDIUMCisco IOS XE Software ASIC Register Write VulnerabilityEPSS 0.3%