Falhas do tipo CWE-347

766 resultados

Divulgação de informações

A aplicação expõe dados sensíveis (credenciais, tokens, informações pessoais, detalhes técnicos) a atores não autorizados através de canais inseguros, logs, mensagens de erro ou respostas HTTP. O risco está em que essas informações podem ser capturadas, armazenadas ou usadas para ataques subsequentes.

Exemplo

Uma API retorna stacktrace completo (com caminhos internos e bibliotecas) em resposta de erro; ou um formulário envia senha em texto plano via HTTP; ou logs de produção contêm tokens de autenticação visíveis em backup público no GitHub.

Como mitigar

Sanitize mensagens de erro para o usuário (log completo apenas internamente), use HTTPS/TLS obrigatório para dados sensíveis, implemente rotação de secrets e nunca exponha tokens/senhas em logs, respostas ou comentários de código. Revise regularmente o que é exposto em respostas da aplicação e em pontos de debug.

CVE-2025-8454CRITICALIt was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scEPSS 0.3%CVE-2022-31123MEDIUMGrafana plugin signature bypass vulnerabilityEPSS 0.3%CVE-2026-10723MEDIUMIncorrect acceptance of NSEC3 recordsEPSS 0.3%CVE-2026-44714HIGHbitcoinj: ScriptExecution P2PKH/P2WPKH Verification BypassEPSS 0.3%CVE-2026-72861MEDIUMAppwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is AbsentEPSS 0.3%CVE-2026-34840HIGHOneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature VerificationEPSS 0.3%CVE-2023-25934MEDIUM DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. A network attacker with an ability toEPSS 0.3%CVE-2025-71402LOWbetter-auth before 1.4.0 Session Revocation via Forged CookieEPSS 0.3%CVE-2026-36721CRITICALA lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authenticatioEPSS 0.3%CVE-2024-7481HIGHImproper signature verification of Printer driver installation in TeamViewer Remote ClientsEPSS 0.3%CVE-2026-45755MEDIUMSymfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event InjectionEPSS 0.3%CVE-2026-68757HIGHPotential improper SAML signature verification in JFrog ArtifactoryEPSS 0.3%CVE-2026-40941HIGHCacti: Package Import Signature Validation Bypass Allows Self-Signed PackagesEPSS 0.3%CVE-2019-1811MEDIUMCisco NX-OS CLI Command Software Image Signature Verification VulnerabilitiesEPSS 0.3%CVE-2019-1810MEDIUMCisco Nexus 3000 Series and 9000 Series Switches in NX-OS Mode CLI Command Software Image Signature Verification VulnerabilityEPSS 0.3%CVE-2024-23960MEDIUMAlpine Halo9 Improper Verification of Cryptographic Signature VulnerabilityEPSS 0.3%CVE-2026-93998HIGHKeycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerEPSS 0.3%CVE-2026-106078MEDIUMA vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses EPSS 0.3%CVE-2026-67278MEDIUMTLS server impersonation possible in Mikrotik RouterOSEPSS 0.3%CVE-2026-4258HIGHVersions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve vEPSS 0.3%