Falhas do tipo CWE-294

240 resultados

Exposição de informações sensíveis a atores não autorizados

Fraqueza na qual dados sensíveis (credenciais, chaves, PII, tokens) são acessíveis por usuários ou processos que não deveriam ter acesso. Ocorre por falhas em controle de acesso, armazenamento inadequado ou transmissão desprotegida, permitindo vazamento ou roubo dessas informações.

Exemplo

Uma aplicação grava tokens de autenticação em logs em texto plano acessíveis via endpoint público, ou armazena senhas sem hash em banco de dados com permissões leitura aberta. Um atacante consegue ler essas credenciais e impersonar usuários legítimos.

Como mitigar

Implemente controle de acesso rigoroso baseado em papéis (RBAC/ABAC), criptografe dados sensíveis em repouso e em trânsito (TLS, AES), nunca registre credenciais em logs, e revise regularmente permissões de arquivos e endpoints para garantir que apenas atores autorizados acessem informações críticas.

CVE-2025-64131HIGHJenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about EPSS 0.5%CVE-2026-121640CRITICALWatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative ActionsEPSS 0.5%CVE-2026-86219CRITICALAuthen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_stepEPSS 0.5%CVE-2024-39081MEDIUMAn issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications.EPSS 0.5%CVE-2025-46815HIGHZITADEL Allows IdP Intent Token ReuseEPSS 0.5%CVE-2026-75907HIGHCVE-2026-75907EPSS 0.5%CVE-2026-84306MEDIUMFilament: Multi-factor authentication (app) codes can still be used after a newer code has been usedEPSS 0.4%CVE-2026-37982MEDIUMKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replayEPSS 0.4%CVE-2026-89070HIGHMOVEit Transfer OIDC Authentication Replay VulnerabilityEPSS 0.4%CVE-2023-45794MEDIUMA vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (AllEPSS 0.4%CVE-2026-55088MEDIUMEtherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author tokenEPSS 0.4%CVE-2022-2226MEDIUMAn OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a diEPSS 0.4%CVE-2026-54779MEDIUMCoreWCF: SAML token replay protection is inoperativeEPSS 0.4%CVE-2025-61479HIGHAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofEPSS 0.4%CVE-2026-17045HIGHIBM i is Affected By Multiple Vulnerabilities in Digital Certificate ManagerEPSS 0.4%CVE-2026-35149HIGHHCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.EPSS 0.4%CVE-2026-1743LOWDJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replayEPSS 0.4%CVE-2026-82470MEDIUMRodauth before 2.47.0 TOTP Code Reuse via Drift WindowEPSS 0.4%CVE-2026-117470MEDIUMWebAuthn assertion replay permits second-factor bypass in Psono ServerEPSS 0.4%CVE-2026-103314HIGHStackrox: stackrox: saml response replay allows multiple central authentication tokensEPSS 0.4%