Falhas do tipo CWE-347

766 resultados

Divulgação de informações

A aplicação expõe dados sensíveis (credenciais, tokens, informações pessoais, detalhes técnicos) a atores não autorizados através de canais inseguros, logs, mensagens de erro ou respostas HTTP. O risco está em que essas informações podem ser capturadas, armazenadas ou usadas para ataques subsequentes.

Exemplo

Uma API retorna stacktrace completo (com caminhos internos e bibliotecas) em resposta de erro; ou um formulário envia senha em texto plano via HTTP; ou logs de produção contêm tokens de autenticação visíveis em backup público no GitHub.

Como mitigar

Sanitize mensagens de erro para o usuário (log completo apenas internamente), use HTTPS/TLS obrigatório para dados sensíveis, implemente rotação de secrets e nunca exponha tokens/senhas em logs, respostas ou comentários de código. Revise regularmente o que é exposto em respostas da aplicação e em pontos de debug.

CVE-2021-22735—Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could aEPSS 1.0%CVE-2020-35169CRITICALDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper InpEPSS 1.0%CVE-2020-26290CRITICALCritical security issues in XML encoding in DexEPSS 1.0%CVE-2021-21405MEDIUMBLS Signature "Malleability"EPSS 1.0%CVE-2017-13083MEDIUMAkeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attEPSS 1.0%CVE-2022-24773MEDIUMImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.0%CVE-2021-25636—Incorrect trust validation of signature with ambiguous KeyInfo childrenEPSS 1.0%CVE-2021-29451CRITICALMissing validation of JWT signature in `ManyDesigns/Portofino`EPSS 0.9%CVE-2022-21134HIGHA firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A spEPSS 0.9%CVE-2024-41138HIGHA library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.281EPSS 0.9%CVE-2025-24043HIGHWinDbg Remote Code Execution VulnerabilityEPSS 0.9%CVE-2020-15091MEDIUMDenial of Service in TenderMintEPSS 0.9%CVE-2020-15216MEDIUMSignature Validation Bypass in goxmldsigEPSS 0.9%CVE-2024-39804HIGHA library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's acceEPSS 0.9%CVE-2026-54733CRITICALmoodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpointEPSS 0.9%CVE-2024-21917CRITICALRockwell Automation FactoryTalk® Service Platform Service Token VulnerabilityEPSS 0.9%CVE-2024-41159HIGHA library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access priEPSS 0.8%CVE-2021-29455HIGHMissing validation of JWT signature in `grassrootza/grassroot-platform`EPSS 0.8%CVE-2020-14515—CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file sigEPSS 0.8%CVE-2024-32962CRITICALXML signature verification bypass due improper verification of signature / signature spoofingEPSS 0.8%