Falhas do tipo CWE-538

106 resultados

Exposição de informações sensíveis em arquivos ou diretórios acessíveis externamente

A aplicação escreve dados sensíveis (senhas, tokens, chaves API, PII) em arquivos ou diretórios que podem ser acessados por usuários não autorizados ou pela internet. Isso acontece por falta de controle de permissões adequado ou armazenamento em local público, expondo credenciais e dados críticos.

Exemplo

Um aplicativo salva chaves de acesso ao banco de dados em um arquivo .config dentro da raiz web, ou gera logs de debug contendo tokens de autenticação em /tmp acessível globalmente. Um atacante consegue ler esses arquivos e comprometer a aplicação ou dados do usuário.

Como mitigar

Armazene dados sensíveis fora do escopo web (diretório não servido), use variáveis de ambiente ou sistemas de gestão de secrets (Vault, AWS Secrets Manager), aplique permissões restritivas (chmod 600) e evite logar ou cachear credenciais em texto plano.

CVE-2026-115711MEDIUMInsertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential DisclosureEPSS 0.2%CVE-2026-67361MEDIUMJoomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.2%CVE-2026-5434MEDIUMImproper storage of sensitive informationEPSS 0.2%CVE-2024-31954HIGHAn issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows. Because it is possible to tamper with the directoEPSS 0.2%CVE-2019-25717MEDIUMDräger Infinity Delta/Kappa Patient Monitors Unauthenticated Log File DisclosureEPSS 0.2%CVE-2025-46820HIGHphpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifactEPSS 0.2%CVE-2025-12699MEDIUMZOLL ePCR IOS Mobile Application Insertion of Sensitive Information into Externally-Accessible File or DirectoryEPSS 0.2%CVE-2026-57442MEDIUMMCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nestedEPSS 0.2%CVE-2026-29114LOWA vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and EPSS 0.2%CVE-2023-38558MEDIUMA vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration ConsoleEPSS 0.2%CVE-2026-50099MEDIUMNaxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directoryEPSS 0.2%CVE-2021-40363—A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versionEPSS 0.2%CVE-2026-25827LOWAn issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what paEPSS 0.2%CVE-2026-27173HIGHApache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line ArgumentsEPSS 0.2%CVE-2025-25586MEDIUMyimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.EPSS 0.2%CVE-2023-5937MEDIUMSensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0EPSS 0.1%CVE-2026-80175LOWDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensEPSS 0.1%CVE-2025-36058MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%CVE-2026-115707MEDIUMInsertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege EscalationEPSS 0.1%CVE-2026-109970MEDIUMClevis: clevis: pkcs#11 token pin written to world-readable fileEPSS 0.1%