Fallos del tipo CWE-93

256 resultados

Divulgação de Informações

Uma fraqueza genérica onde a aplicação expõe dados sensíveis (credenciais, tokens, IPs, estrutura interna) a atores não autorizados, seja através de mensagens de erro verbosas, logs acessíveis, respostas HTTP malformadas ou canais inseguros. O risco está em fornecer inteligência ao atacante para explorar outros vetores.

Ejemplo

Um servidor Java expõe stack traces completos em páginas de erro 500, revelando caminhos internos, versões de bibliotecas e nomes de bancos de dados; ou uma API retorna tokens JWT em plaintext em queries de URL em vez de headers, sendo capturados por proxy ou histórico do navegador.

Cómo mitigar

Implemente tratamento genérico de exceções (não exponha detalhes técnicos ao cliente), sanitize mensagens de erro, configure logs fora do escopo público, use HTTPS obrigatório, e revise respostas HTTP quanto a dados sensíveis. Em produção, desabilite debug mode e verbose error messages.

CVE-2025-61884HIGHVulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected aEPSS 95.9%KEVCVE-2022-0666HIGHCRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweberEPSS 44.3%CVE-2016-3115MEDIUMMultiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended sheEPSS 35.5%CVE-2024-20337HIGHA vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriEPSS 29.9%CVE-2021-39172HIGHNew line injection during configuration editionEPSS 29.2%CVE-2019-9740MEDIUMAn issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the atEPSS 5.4%CVE-2019-9947MEDIUMAn issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the atEPSS 5.3%CVE-2023-4767MEDIUMImproper Neutralization of CRLF Sequences in ManageEngine Desktop CentralEPSS 3.5%CVE-2023-4768MEDIUMImproper Neutralization of CRLF Sequences in ManageEngine Desktop CentralEPSS 3.5%CVE-2022-31014MEDIUMSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerEPSS 2.5%CVE-2018-12537—In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and linEPSS 2.5%CVE-2020-11078MEDIUMCRLF injection in httplib2EPSS 2.4%CVE-2021-31164—Apache Unomi log injectionEPSS 2.3%CVE-2026-39983HIGHFTP Command Injection via CRLF in basic-ftpEPSS 2.2%CVE-2026-72590CRITICALalseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars ParameterEPSS 2.0%CVE-2026-82854CRITICALNodemailer before 8.0.4 SMTP Command Injection via envelope.sizeEPSS 2.0%CVE-2025-57804MEDIUMh2 allows HTTP Request Smuggling due to illegal characters in headersEPSS 1.9%CVE-2026-111228MEDIUMNetgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.phpEPSS 1.8%CVE-2026-111227MEDIUMNetgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.phpEPSS 1.8%CVE-2025-59419MEDIUMNetty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email ForgeryEPSS 1.6%