Falhas do tipo CWE-117

121 resultados

Injeção em logs (Log Injection)

O software escreve dados não sanitizados nos logs, permitindo que um atacante injete conteúdo malicioso (quebras de linha, caracteres de controle, formatação falsa) que pode ser interpretado como eventos legítimos, mascarar atividades suspeitas ou enganar ferramentas de monitoramento.

Exemplo

Um servidor web registra a URL solicitada diretamente no log sem filtrar quebras de linha. Um atacante envia requisição com payload como `/page?id=123%0aAdmin login failed`, que escreve nos logs como se fosse dois eventos separados, ocultando a atividade real ou imitando um acesso autorizado.

Como mitigar

Sanitize todos os dados antes de escrever em logs: remova ou escape caracteres de controle (\n, \r, \0), use formatação estruturada (JSON, syslog) em vez de concatenação de strings, e implemente validação rigorosa de entrada. Ferramentas de SIEM devem também rejeitar logs com estrutura inesperada.

CVE-2026-15603MEDIUMmorgan vulnerable to Log Forging via unescaped Unicode line separatorsEPSS 0.2%CVE-2026-1337LOWInsufficient escaping of unicode characters in query logEPSS 0.2%CVE-2025-54389MEDIUMAIDE improper output neutralization vulnerabilityEPSS 0.2%CVE-2024-7696MEDIUMSeth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamEPSS 0.2%CVE-2025-36081MEDIUMMultiple Vulnerabilities in IBM Concert Software.EPSS 0.2%CVE-2026-16189MEDIUMIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.2%CVE-2026-45679MEDIUMOpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messagesEPSS 0.2%CVE-2026-18148MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.2%CVE-2026-20260MEDIUMLog Injection through HTTP Request Paths in Splunk SOAREPSS 0.2%CVE-2026-81695CRITICALopenssl_encrypt before 1.4.9 Terminal Injection via key_idEPSS 0.2%CVE-2026-81696CRITICALopenssl_encrypt before 1.4.9 Terminal Injection via info CommandEPSS 0.2%CVE-2026-81694CRITICALverify-usb before 1.4.9 Output Injection via Unsanitized FilenamesEPSS 0.2%CVE-2026-9736MEDIUMVulnerabilities exists in IBM Netezza SoftwareEPSS 0.2%CVE-2026-11538LOWIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.2%CVE-2025-49846MEDIUMwire-ios accidentally logs message contentsEPSS 0.1%CVE-2024-23194LOWImproper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to EPSS 0.1%CVE-2025-11537MEDIUMKeycloak-services: sensitive headers shown in the http access logsEPSS 0.1%CVE-2025-14684MEDIUMIBM Maximo Application Suite - Monitor Component uses Log Forging which is vulnerable to .EPSS 0.1%CVE-2026-74885CRITICALopenssl_encrypt before 1.4.0 Logging Bug and Race ConditionEPSS 0.1%CVE-2025-36159MEDIUMIBM Concert Improper Log NeutralizationEPSS 0.1%