Falhas do tipo CWE-294

236 resultados

Exposição de informações sensíveis a atores não autorizados

Fraqueza na qual dados sensíveis (credenciais, chaves, PII, tokens) são acessíveis por usuários ou processos que não deveriam ter acesso. Ocorre por falhas em controle de acesso, armazenamento inadequado ou transmissão desprotegida, permitindo vazamento ou roubo dessas informações.

Exemplo

Uma aplicação grava tokens de autenticação em logs em texto plano acessíveis via endpoint público, ou armazena senhas sem hash em banco de dados com permissões leitura aberta. Um atacante consegue ler essas credenciais e impersonar usuários legítimos.

Como mitigar

Implemente controle de acesso rigoroso baseado em papéis (RBAC/ABAC), criptografe dados sensíveis em repouso e em trânsito (TLS, AES), nunca registre credenciais em logs, e revise regularmente permissões de arquivos e endpoints para garantir que apenas atores autorizados acessem informações críticas.

CVE-2024-3982HIGHAn attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product andEPSS 0.2%CVE-2024-38890HIGHAn issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attEPSS 0.2%CVE-2024-38272HIGHAuth Bypass in Quick ShareEPSS 0.2%CVE-2026-9226MEDIUMAuthentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take overEPSS 0.2%CVE-2026-55167MEDIUMLDAP Account Manager: WebAuthn authentication challenge is kept in the PHP sessionEPSS 0.2%CVE-2025-54810HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Authentication Bypass by Capture-replayEPSS 0.2%CVE-2026-34021HIGHLack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replayEPSS 0.2%CVE-2026-54783HIGHCoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messagesEPSS 0.2%CVE-2025-65553MEDIUMD3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range EPSS 0.2%CVE-2025-61480HIGHAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofEPSS 0.2%CVE-2026-47133MEDIUMClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshotsEPSS 0.2%CVE-2026-45720HIGHOmni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session tokenEPSS 0.1%CVE-2024-4009HIGHReplay Attack in KNX Secure DevicesEPSS 0.1%CVE-2026-104381MEDIUMFireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of ServiceEPSS 0.1%CVE-2026-49322MEDIUMIndian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchangeEPSS 0.1%CVE-2018-9477HIGHIn the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. This coEPSS 0.1%