Falhas do tipo CWE-668

253 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (senhas, tokens, dados pessoais, configurações internas) através de canais inadequados: mensagens de erro verbosas, logs acessíveis, memória não limpa, headers HTTP desnecessários ou comportamentos diferenciados que vazam pistas. O risco está em que um atacante consegue reunir informações que facilitam outros ataques ou violam privacidade.

Exemplo

Um endpoint retorna 'Usuário não encontrado no banco de dados' em vez de apenas 'Credenciais inválidas', permitindo que alguém enumere usuários válidos; ou a aplicação deixa tokens JWT em cookies acessíveis ao JavaScript malicioso; ou logs de erro com stack traces são servidos publicamente.

Como mitigar

Sanitize mensagens de erro (respostas genéricas ao usuário final, logs detalhados apenas em backend seguro); revise headers HTTP (remova versões de software, X-Powered-By); nunca armazene segredos em código-fonte, variáveis de ambiente ou comentários; implemente rotação e expiração de tokens; configure logs com controle de acesso restrito e sem dados sensíveis em strings de debug.

CVE-2023-2622LOW Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup servicEPSS 0.4%CVE-2024-51754LOWUnguarded calls to __toString() when nesting an object into an array in TwigEPSS 0.4%CVE-2026-14611MEDIUMDeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resourceEPSS 0.4%CVE-2026-50607LOWWebSocket Exposure Vulnerability in NitroSense and PredatorSense SoftwareEPSS 0.4%CVE-2026-92940CRITICALvm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgentEPSS 0.4%CVE-2024-51755LOWUnguarded calls to __isset() and to array-accesses when the sandbox is enabled in TwigEPSS 0.4%CVE-2026-32690LOWApache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1EPSS 0.4%CVE-2022-38474MEDIUMA website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not alloEPSS 0.4%CVE-2026-48499CRITICALActivepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cacheEPSS 0.4%CVE-2026-85053HIGHImproper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insidEPSS 0.4%CVE-2026-53648MEDIUMFOSSBilling: Downloadable product files can be overwritten through filename collisionsEPSS 0.4%CVE-2019-13546—In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an uEPSS 0.4%CVE-2024-39553MEDIUMJunos OS Evolved: Receipt of arbitrary data when sampling service is enabled, leads to partial Denial of Service (DoS).EPSS 0.4%CVE-2018-8861—Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 andEPSS 0.4%CVE-2025-61917HIGHn8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task RunnerEPSS 0.4%CVE-2026-59835HIGHA exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may alloEPSS 0.4%CVE-2026-102125HIGHKiteworks Core Sandbox EscapeEPSS 0.4%CVE-2023-29192LOWSilverwareGames.io users with access to the game upload panel are able to edit download links for games uploaded by other developersEPSS 0.4%CVE-2026-72782HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Environment Variable LeakEPSS 0.4%CVE-2026-26057MEDIUMSkill Scanner Unsecured Network Binding VulnerabilityEPSS 0.4%