Fallos del tipo CWE-88

378 resultados

Divulgação de Informações

Fraqueza onde a aplicação expõe dados sensíveis — senhas, tokens, chaves criptográficas, dados pessoais — para atores não autorizados. Pode ocorrer por erro de configuração, logs inadequados, mensagens de erro verbosas, armazenamento inseguro ou falta de controle de acesso.

Ejemplo

Um serviço web retorna a senha do banco de dados em mensagens de erro quando a conexão falha, ou uma API deixa chaves de API visíveis em arquivos de configuração commitados no repositório público. Outro caso: logs de produção contendo tokens de autenticação que qualquer pessoa com acesso ao servidor consegue ler.

Cómo mitigar

Implemente controle de acesso baseado em roles, sanitize mensagens de erro para usuários finais (log detalhado apenas internamente), revise variáveis de ambiente e configurações, nunca commite segredos no repositório, e aplique mascaramento em logs (ex: exibir apenas últimos 4 dígitos de tokens). Use scanners de secrets no CI/CD.

CVE-2026-87900CRITICALArgument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute aEPSS 0.7%CVE-2026-73294CRITICALSemaphore U: OS Command InjectionEPSS 0.7%CVE-2025-49008CRITICALAtheos Improper Input Validation Vulnerability Enables RCE in Common.phpEPSS 0.6%CVE-2026-22583CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CEPSS 0.6%CVE-2026-22582CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MEPSS 0.6%CVE-2025-59489HIGHUnity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code fEPSS 0.6%CVE-2025-32457HIGHON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument InjectionEPSS 0.6%CVE-2025-32458HIGHON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument InjectionEPSS 0.6%CVE-2025-32456HIGHON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument InjectionEPSS 0.6%CVE-2025-32455HIGHON Semiconductor Quantenna router_command.sh (in the run_cmd argument) Argument InjectionEPSS 0.6%CVE-2025-32459HIGHON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument InjectionEPSS 0.6%CVE-2025-3459HIGHON Semiconductor Quantenna transmit_file Argument InjectionEPSS 0.6%CVE-2026-54337CRITICALFireshare has Unauthenticated Argument Injection to Arbitrary File Write/OverwriteEPSS 0.6%CVE-2026-84502CRITICALAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podEPSS 0.6%CVE-2026-53790CRITICALrsync < 3.5.0 Command Injection via Multiple Code PathsEPSS 0.6%CVE-2020-3380HIGHCisco Data Center Network Manager Privilege Escalation VulnerabilityEPSS 0.6%CVE-2025-53542HIGHKubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSignEPSS 0.6%CVE-2025-49520HIGHEvent-driven-ansible: authenticated argument injection in git url in eda project creationEPSS 0.6%CVE-2026-25689MEDIUMAn improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeEPSS 0.6%CVE-2025-3945HIGHImproper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)EPSS 0.6%