Falhas do tipo CWE-294

240 resultados

Exposição de informações sensíveis a atores não autorizados

Fraqueza na qual dados sensíveis (credenciais, chaves, PII, tokens) são acessíveis por usuários ou processos que não deveriam ter acesso. Ocorre por falhas em controle de acesso, armazenamento inadequado ou transmissão desprotegida, permitindo vazamento ou roubo dessas informações.

Exemplo

Uma aplicação grava tokens de autenticação em logs em texto plano acessíveis via endpoint público, ou armazena senhas sem hash em banco de dados com permissões leitura aberta. Um atacante consegue ler essas credenciais e impersonar usuários legítimos.

Como mitigar

Implemente controle de acesso rigoroso baseado em papéis (RBAC/ABAC), criptografe dados sensíveis em repouso e em trânsito (TLS, AES), nunca registre credenciais em logs, e revise regularmente permissões de arquivos e endpoints para garantir que apenas atores autorizados acessem informações críticas.

CVE-2026-12704MEDIUMSAML assertion replay via skipped InResponseTo validationEPSS 0.3%CVE-2023-31759HIGHWeak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack.EPSS 0.3%CVE-2023-31762HIGHWeak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a cEPSS 0.3%CVE-2023-31763HIGHWeak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.EPSS 0.3%CVE-2025-56448MEDIUMThe Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The EPSS 0.3%CVE-2023-31761HIGHWeak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via EPSS 0.3%CVE-2024-43099HIGHAutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replayEPSS 0.3%CVE-2026-28449MEDIUMOpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay SuppressionEPSS 0.3%CVE-2025-47706MEDIUMEnterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052EPSS 0.3%CVE-2025-36593HIGHDell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS EPSS 0.3%CVE-2023-46892HIGHThe radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record EPSS 0.3%CVE-2026-53636MEDIUMOpen edX LTI OAuth Replay AttackEPSS 0.3%CVE-2023-50786MEDIUMDradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. TEPSS 0.3%CVE-2026-92120CRITICALApache Allura: Oauth1 Replay AttackEPSS 0.3%CVE-2026-73443MEDIUMOn affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefEPSS 0.3%CVE-2021-46835MEDIUMThere is a traffic hijacking vulnerability in WS7200-10 11.0.2.13. Successful exploitation of this vulnerability can cause packets to be hijEPSS 0.3%CVE-2026-12655HIGH1732E ArmorBlock® - Multiple VulnerabilitiesEPSS 0.3%CVE-2025-68671MEDIUMlakeFS is Missing Timestamp Validation in S3 Gateway AuthenticationEPSS 0.3%CVE-2026-104105MEDIUMFileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)EPSS 0.3%CVE-2026-114617MEDIUMAuthlib: ID token can disable its own nonce validation via the nonce_supported claimEPSS 0.3%