Fallos del tipo CWE-779

20 resultados

Registro excessivo de dados sensíveis

Quando uma aplicação registra em logs mais informação do que deveria, incluindo dados sensíveis como senhas, tokens, números de cartão ou PII (Informações Pessoais Identificáveis). O risco é que logs são frequentemente armazenados em texto plano, acessíveis a múltiplos sistemas e pessoas, expondo essas informações a quem não deveria ter acesso.

Ejemplo

Um sistema de autenticação que escreve em log: '[14:32:15] Usuario login falhou: email=user@example.com senha=abc123xyz'. Se um atacante comprometer o servidor de logs ou um administrador mal-intencionado acessar os arquivos, as credenciais são obtidas diretamente.

Cómo mitigar

Implementar sanitização de logs: remover ou ofuscar dados sensíveis antes de registrar (ex: logar apenas os primeiros 4 dígitos de um cartão, nunca a senha completa). Usar níveis de log apropriados (DEBUG vs PRODUCTION) e rotacionar logs regularmente com exclusão segura de arquivo antigos que contenham dados sensíveis.

CVE-2024-36416HIGHSuiteCRM v4 API Excessive log data DOSEPSS 2.0%CVE-2024-36072CRITICALNetwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logginEPSS 1.0%CVE-2022-31004HIGHPotential secrets being logged to disk in CVE ServicesEPSS 0.9%CVE-2025-51397MEDIUMA stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrarEPSS 0.9%CVE-2024-55628HIGHSuricata oversized resource names utilizing DNS name compression can lead to resource starvationEPSS 0.7%CVE-2023-23949HIGHAn authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.EPSS 0.6%CVE-2022-25779MEDIUMInsufficient scope checks allows adding unrelated audit log entriesEPSS 0.5%CVE-2025-8696HIGHDoS attack against the Stork UI from an unauthenticated userEPSS 0.4%CVE-2026-28718MEDIUMDenial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber ProtectEPSS 0.3%CVE-2025-69230LOWAIOHTTP Vulnerable to Cookie Parser Warning StormEPSS 0.3%CVE-2025-53636MEDIUMOpen OnDemand Shell App closed websocket DoSEPSS 0.3%CVE-2021-25422—Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak WEPSS 0.2%CVE-2021-25423—Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak EPSS 0.2%CVE-2021-25421—Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak EPSS 0.2%CVE-2021-25420—Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak WEPSS 0.2%CVE-2024-1141MEDIUMGlance-store: glance store access key logged in debug log levelEPSS 0.2%CVE-2026-20209MEDIUMCisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-20210MEDIUMCisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityEPSS 0.2%CVE-2022-39874MEDIUMSensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.EPSS 0.2%CVE-2022-22291MEDIUMLogging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get Cell Location InformEPSS 0.1%