Falhas do tipo CWE-347

641 resultados

Divulgação de informações

A aplicação expõe dados sensíveis (credenciais, tokens, informações pessoais, detalhes técnicos) a atores não autorizados através de canais inseguros, logs, mensagens de erro ou respostas HTTP. O risco está em que essas informações podem ser capturadas, armazenadas ou usadas para ataques subsequentes.

Exemplo

Uma API retorna stacktrace completo (com caminhos internos e bibliotecas) em resposta de erro; ou um formulário envia senha em texto plano via HTTP; ou logs de produção contêm tokens de autenticação visíveis em backup público no GitHub.

Como mitigar

Sanitize mensagens de erro para o usuário (log completo apenas internamente), use HTTPS/TLS obrigatório para dados sensíveis, implemente rotação de secrets e nunca exponha tokens/senhas em logs, respostas ou comentários de código. Revise regularmente o que é exposto em respostas da aplicação e em pontos de debug.

CVE-2026-53501HIGHThumbor has HMAC validation bypass via multiple .replace() calls when removing URL signatureEPSS 0.2%CVE-2020-3138—Cisco Enterprise NFV Infrastructure Software Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-44720MEDIUMOpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account TakeoverEPSS 0.2%CVE-2026-5050HIGHPayment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status ManipulationEPSS 0.2%CVE-2026-31946CRITICALOpenOLAT: Authentication bypass via forged JWT in OIDC implicit flowEPSS 0.2%CVE-2026-69646HIGHSkype for Business Spoofing VulnerabilityEPSS 0.2%CVE-2025-71402LOWbetter-auth before 1.4.0 Session Revocation via Forged CookieEPSS 0.2%CVE-2025-2763MEDIUMCarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution VulnerabilityEPSS 0.2%CVE-2026-34872CRITICALAn issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH duEPSS 0.2%CVE-2021-1244MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2022-42793MEDIUMAn issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 1EPSS 0.2%CVE-2021-1136MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2026-54774HIGHCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateEPSS 0.2%CVE-2025-55311MEDIUMAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript tEPSS 0.2%CVE-2025-12150LOWOrg.keycloak/keycloak-services: webauthn attestation statement verification bypassEPSS 0.2%CVE-2026-74876CRITICALopenssl_encrypt before 1.4.0 Unverified Key Bundle EncryptionEPSS 0.2%CVE-2026-34068MEDIUMnimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledgeEPSS 0.2%CVE-2026-72861MEDIUMAppwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is AbsentEPSS 0.2%CVE-2026-32144HIGHOCSP designated-responder authorization bypass via missing signature verificationEPSS 0.2%CVE-2026-28198CRITICALPrivilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS ShellEPSS 0.2%