Falhas do tipo CWE-347

766 resultados

Divulgação de informações

A aplicação expõe dados sensíveis (credenciais, tokens, informações pessoais, detalhes técnicos) a atores não autorizados através de canais inseguros, logs, mensagens de erro ou respostas HTTP. O risco está em que essas informações podem ser capturadas, armazenadas ou usadas para ataques subsequentes.

Exemplo

Uma API retorna stacktrace completo (com caminhos internos e bibliotecas) em resposta de erro; ou um formulário envia senha em texto plano via HTTP; ou logs de produção contêm tokens de autenticação visíveis em backup público no GitHub.

Como mitigar

Sanitize mensagens de erro para o usuário (log completo apenas internamente), use HTTPS/TLS obrigatório para dados sensíveis, implemente rotação de secrets e nunca exponha tokens/senhas em logs, respostas ou comentários de código. Revise regularmente o que é exposto em respostas da aplicação e em pontos de debug.

CVE-2026-48021CRITICALepa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vauEPSS 0.2%CVE-2024-32911HIGHThere is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additioEPSS 0.2%CVE-2026-41669HIGHAdmidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests ProcessedEPSS 0.2%CVE-2026-63182HIGHLightSAML: Signature reference wrapping permits unsigned assertion claimsEPSS 0.2%CVE-2026-6331LOWHMAC zero-length tag forgery in EVP_DigestVerifyFinalEPSS 0.2%CVE-2021-26391HIGHInsufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gaEPSS 0.2%CVE-2026-57122HIGHPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)EPSS 0.2%CVE-2022-20929HIGHA vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticatedEPSS 0.2%CVE-2026-44497CRITICALZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale BufferEPSS 0.2%CVE-2023-28806MEDIUMSignature validation error in DLL allows disabling anti-tampering protectionEPSS 0.2%CVE-2026-86326HIGHAn improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify thEPSS 0.2%CVE-2026-56837HIGHPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingEPSS 0.2%CVE-2024-2307MEDIUMOsbuild-composer: race condition may disable gpg verification for package repositoriesEPSS 0.2%CVE-2026-121970MEDIUMPay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature ForgeryEPSS 0.2%CVE-2026-46560HIGHOpenAM Authentication Bypass via RADIUS SpoofingEPSS 0.2%CVE-2026-14999HIGHIBM DataPower Gateway Improper Verification of Cryptographic SignatureEPSS 0.2%CVE-2019-0071HIGHJunos OS: EX2300, EX3400 Series: Veriexec signature checking not enforced in specific versions of Junos OSEPSS 0.2%CVE-2019-1808MEDIUMCisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification VulnerabilityEPSS 0.2%CVE-2026-18152HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2025-67903MEDIUMNorthern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.EPSS 0.2%