Fallos del tipo CWE-93

256 resultados

Divulgação de Informações

Uma fraqueza genérica onde a aplicação expõe dados sensíveis (credenciais, tokens, IPs, estrutura interna) a atores não autorizados, seja através de mensagens de erro verbosas, logs acessíveis, respostas HTTP malformadas ou canais inseguros. O risco está em fornecer inteligência ao atacante para explorar outros vetores.

Ejemplo

Um servidor Java expõe stack traces completos em páginas de erro 500, revelando caminhos internos, versões de bibliotecas e nomes de bancos de dados; ou uma API retorna tokens JWT em plaintext em queries de URL em vez de headers, sendo capturados por proxy ou histórico do navegador.

Cómo mitigar

Implemente tratamento genérico de exceções (não exponha detalhes técnicos ao cliente), sanitize mensagens de erro, configure logs fora do escopo público, use HTTPS obrigatório, e revise respostas HTTP quanto a dados sensíveis. Em produção, desabilite debug mode e verbose error messages.

CVE-2026-3848MEDIUMImproper Neutralization of CRLF Sequences ('CRLF Injection') in GitLabEPSS 0.2%CVE-2026-42586MEDIUMNetty: CRLF Injection in Netty Redis Codec EncoderEPSS 0.2%CVE-2025-54972LOWAn improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 thrEPSS 0.2%CVE-2026-43882MEDIUMWWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event SpoofingEPSS 0.2%CVE-2022-50682MEDIUMKentico Xperience <= 13.0.79 Routing Engine CRLF InjectionEPSS 0.2%CVE-2026-72913HIGHKitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequencesEPSS 0.2%CVE-2026-49756LOWMultipart form-data header injection in Req via unescaped name/filename/content_typeEPSS 0.2%CVE-2026-91839HIGHNetworkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentialsEPSS 0.2%CVE-2026-8722MEDIUMNet::Async::Statsd::Client versions through 0.005 for Perl allow metric injectionsEPSS 0.2%CVE-2026-34975HIGHPlunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headersEPSS 0.2%CVE-2026-87678MEDIUMAn input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. WhEPSS 0.2%CVE-2026-94057MEDIUMExim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted dataEPSS 0.2%CVE-2026-65636LOWYAML injection via unescaped newlines in ymlr document commentsEPSS 0.2%CVE-2026-35601MEDIUMVikunja has an iCalendar Property Injection via CRLF in CalDAV Task OutputEPSS 0.2%CVE-2026-3634LOWLibsoup: libsoup: http header injection and response splitting via crlf injection in content-type headerEPSS 0.2%CVE-2026-91841HIGHNetworkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injectionEPSS 0.2%CVE-2026-87661MEDIUMBrocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup orEPSS 0.2%CVE-2026-91840HIGHNetworkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn usernameEPSS 0.2%CVE-2026-121432MEDIUMAzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS PlaylistEPSS 0.2%CVE-2026-41570HIGHPHPUnit: Argument injection via newline in PHP INI values forwarded to child processesEPSS 0.2%