Fallos del tipo CWE-88

378 resultados

Divulgação de Informações

Fraqueza onde a aplicação expõe dados sensíveis — senhas, tokens, chaves criptográficas, dados pessoais — para atores não autorizados. Pode ocorrer por erro de configuração, logs inadequados, mensagens de erro verbosas, armazenamento inseguro ou falta de controle de acesso.

Ejemplo

Um serviço web retorna a senha do banco de dados em mensagens de erro quando a conexão falha, ou uma API deixa chaves de API visíveis em arquivos de configuração commitados no repositório público. Outro caso: logs de produção contendo tokens de autenticação que qualquer pessoa com acesso ao servidor consegue ler.

Cómo mitigar

Implemente controle de acesso baseado em roles, sanitize mensagens de erro para usuários finais (log detalhado apenas internamente), revise variáveis de ambiente e configurações, nunca commite segredos no repositório, e aplique mascaramento em logs (ex: exibir apenas últimos 4 dígitos de tokens). Use scanners de secrets no CI/CD.

CVE-2026-105326LOWCups: cups: argument injection in mailto notifier via notify-recipient-uriEPSS 0.2%CVE-2025-59433MEDIUM@conventional-changelog/git-client has an Argument Injection vulnerabilityEPSS 0.2%CVE-2026-35153MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2EPSS 0.2%CVE-2025-43730HIGHDell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument InjectionEPSS 0.2%CVE-2026-80427HIGHbestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option DelimiterEPSS 0.2%CVE-2026-20063MEDIUMCisco Secure FTD Software Authenticated Command Injection VulnerabilityEPSS 0.2%CVE-2026-71464LOWAutomation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guardEPSS 0.2%CVE-2026-71465LOWAutomation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executableEPSS 0.2%CVE-2026-86022HIGHVNote: Argument injection to arbitrary command execution via crafted note filename in external-program handlingEPSS 0.2%CVE-2026-87687HIGHAn authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An autheEPSS 0.2%CVE-2026-14459HIGHArgument Injection in TUBITAK BILGEM's pardus-softwareEPSS 0.2%CVE-2026-102904MEDIUMJupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLsEPSS 0.2%CVE-2026-44968MEDIUMdbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type ParametersEPSS 0.2%CVE-2025-6232HIGHAn improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute coEPSS 0.2%CVE-2025-6231HIGHAn improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute coEPSS 0.2%CVE-2025-36565MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releasEPSS 0.2%CVE-2026-15793MEDIUMGit source checkout from a bundle file could lead to command injectionEPSS 0.2%CVE-2026-78635MEDIUMImproper Input Validation in the Okta Privileged Access SSH Client URL Handler ArgumentEPSS 0.2%CVE-2026-107734HIGHSumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External EditorsEPSS 0.2%CVE-2026-107802HIGHSumatraPDF — Windows command-line argument injection in AI selection-translateEPSS 0.2%