Fallos del tipo CWE-88

378 resultados

Divulgação de Informações

Fraqueza onde a aplicação expõe dados sensíveis — senhas, tokens, chaves criptográficas, dados pessoais — para atores não autorizados. Pode ocorrer por erro de configuração, logs inadequados, mensagens de erro verbosas, armazenamento inseguro ou falta de controle de acesso.

Ejemplo

Um serviço web retorna a senha do banco de dados em mensagens de erro quando a conexão falha, ou uma API deixa chaves de API visíveis em arquivos de configuração commitados no repositório público. Outro caso: logs de produção contendo tokens de autenticação que qualquer pessoa com acesso ao servidor consegue ler.

Cómo mitigar

Implemente controle de acesso baseado em roles, sanitize mensagens de erro para usuários finais (log detalhado apenas internamente), revise variáveis de ambiente e configurações, nunca commite segredos no repositório, e aplique mascaramento em logs (ex: exibir apenas últimos 4 dígitos de tokens). Use scanners de secrets no CI/CD.

CVE-2026-94588MEDIUMIn Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper EPSS 0.2%CVE-2026-116252HIGHpgAdmin 4: Materialized view refresh redirects its connection through a crafted database nameEPSS 0.2%CVE-2026-7725MEDIUMPrefectHQ prefect GitRepository Pull storage.py argument injectionEPSS 0.2%CVE-2026-8773MEDIUMlinlinjava litemall Database Setting DbUtil.java load argument injectionEPSS 0.2%CVE-2026-23924MEDIUMAgent 2 Docker plugin arbitrary file read via Docker API injectionEPSS 0.2%CVE-2026-25690MEDIUMAn improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through EPSS 0.2%CVE-2026-41013HIGHTenant-controlled comma smuggles arbitrary CIFS mount optionsEPSS 0.2%CVE-2026-48711HIGHSSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')EPSS 0.2%CVE-2026-68766HIGHhashcat through 7.1.2 Arbitrary File Write via Restore File Option InjectionEPSS 0.2%CVE-2026-40113HIGHPraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsEPSS 0.2%CVE-2026-89066HIGHOS command injection in the task synthesis component in projenEPSS 0.2%CVE-2026-24739MEDIUMSymfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operationsEPSS 0.2%CVE-2026-55887HIGHMCP Gateway: Argument injection via OCI image label YAML in Docker MCP GatewayEPSS 0.2%CVE-2026-11332HIGHAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionEPSS 0.2%CVE-2026-43698HIGHAn injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 1EPSS 0.2%CVE-2026-12171HIGHauto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRFEPSS 0.2%CVE-2026-105326LOWCups: cups: argument injection in mailto notifier via notify-recipient-uriEPSS 0.2%CVE-2025-59433MEDIUM@conventional-changelog/git-client has an Argument Injection vulnerabilityEPSS 0.2%CVE-2026-35153MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2EPSS 0.2%CVE-2025-43730HIGHDell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument InjectionEPSS 0.2%