Falhas do tipo CWE-347

766 resultados

Divulgação de informações

A aplicação expõe dados sensíveis (credenciais, tokens, informações pessoais, detalhes técnicos) a atores não autorizados através de canais inseguros, logs, mensagens de erro ou respostas HTTP. O risco está em que essas informações podem ser capturadas, armazenadas ou usadas para ataques subsequentes.

Exemplo

Uma API retorna stacktrace completo (com caminhos internos e bibliotecas) em resposta de erro; ou um formulário envia senha em texto plano via HTTP; ou logs de produção contêm tokens de autenticação visíveis em backup público no GitHub.

Como mitigar

Sanitize mensagens de erro para o usuário (log completo apenas internamente), use HTTPS/TLS obrigatório para dados sensíveis, implemente rotação de secrets e nunca exponha tokens/senhas em logs, respostas ou comentários de código. Revise regularmente o que é exposto em respostas da aplicação e em pontos de debug.

CVE-2026-24807MEDIUMBuffer Overflow Vulnerability in liuyueyi/quick-mediaEPSS 0.4%CVE-2026-3564CRITICALScreenConnect Instance Level Cryptographic Material ExposureEPSS 0.4%CVE-2026-75939HIGHOpenshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumedEPSS 0.4%CVE-2026-102502MEDIUMCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)EPSS 0.4%CVE-2025-20178MEDIUMCisco Secure Network Analytics Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-54773MEDIUMCoreWCF: WS-Security signature substitution via document-wide Signature lookupEPSS 0.4%CVE-2026-13089HIGHOIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verifyEPSS 0.4%CVE-2026-65616HIGHPotential privilege escalation to JFrog administrator privilegesEPSS 0.4%CVE-2023-47122MEDIUMGitsign's Rekor public keys fetched from upstream API instead of local TUF client.EPSS 0.4%CVE-2022-39200HIGHSignature checks not applied to some retrieved missing eventsEPSS 0.4%CVE-2026-54330HIGHCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalationEPSS 0.4%CVE-2026-9027MEDIUMCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST EndpointEPSS 0.4%CVE-2024-11696MEDIUMThe application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flawEPSS 0.4%CVE-2026-4600CRITICALVersions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameEPSS 0.4%CVE-2023-53951CRITICALEver Gauzy v0.281.9 JWT Authentication Weakness via HMAC SecretEPSS 0.4%CVE-2026-107722CRITICALfast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionEPSS 0.4%CVE-2023-25574CRITICALJupyterHub's LTI13Authenticator: JWT signature not validatedEPSS 0.4%CVE-2026-111062LOWA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestEPSS 0.4%CVE-2023-41037MEDIUMCleartext Signed Message Signature Spoofing in openpgpjsEPSS 0.4%CVE-2023-33959HIGHVerification bypass can cause users into verifying the wrong artifactEPSS 0.4%