Falhas do tipo CWE-347

766 resultados

Divulgação de informações

A aplicação expõe dados sensíveis (credenciais, tokens, informações pessoais, detalhes técnicos) a atores não autorizados através de canais inseguros, logs, mensagens de erro ou respostas HTTP. O risco está em que essas informações podem ser capturadas, armazenadas ou usadas para ataques subsequentes.

Exemplo

Uma API retorna stacktrace completo (com caminhos internos e bibliotecas) em resposta de erro; ou um formulário envia senha em texto plano via HTTP; ou logs de produção contêm tokens de autenticação visíveis em backup público no GitHub.

Como mitigar

Sanitize mensagens de erro para o usuário (log completo apenas internamente), use HTTPS/TLS obrigatório para dados sensíveis, implemente rotação de secrets e nunca exponha tokens/senhas em logs, respostas ou comentários de código. Revise regularmente o que é exposto em respostas da aplicação e em pontos de debug.

CVE-2020-3138—Cisco Enterprise NFV Infrastructure Software Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-15598MEDIUMDataease SQLBot JWT Token auth.py validateEmbedded signature verificationEPSS 0.2%CVE-2026-34872CRITICALAn issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH duEPSS 0.2%CVE-2026-61855MEDIUMZammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound MailEPSS 0.2%CVE-2026-44720MEDIUMOpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account TakeoverEPSS 0.2%CVE-2021-1244MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2021-1136MEDIUMCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesEPSS 0.2%CVE-2026-32144HIGHOCSP designated-responder authorization bypass via missing signature verificationEPSS 0.2%CVE-2026-94212MEDIUMApache APISIX: unauthenticated impersonation issue in saml-authEPSS 0.2%CVE-2025-2763MEDIUMCarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution VulnerabilityEPSS 0.2%CVE-2026-22696CRITICALdcap-qvl has Missing Verification for QE IdentityEPSS 0.2%CVE-2025-4371HIGHA potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical acceEPSS 0.2%CVE-2026-104435HIGHZebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without OutputEPSS 0.2%CVE-2026-119561HIGHphpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServerEPSS 0.2%CVE-2026-68745HIGHApache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdPEPSS 0.2%CVE-2026-81680CRITICALopenssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot RemovalEPSS 0.2%CVE-2025-55039MEDIUMApache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksEPSS 0.2%CVE-2026-54774HIGHCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateEPSS 0.2%CVE-2025-55311MEDIUMAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript tEPSS 0.2%CVE-2026-22866LOWENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding ValidationEPSS 0.2%