Falhas do tipo CWE-668

253 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (senhas, tokens, dados pessoais, configurações internas) através de canais inadequados: mensagens de erro verbosas, logs acessíveis, memória não limpa, headers HTTP desnecessários ou comportamentos diferenciados que vazam pistas. O risco está em que um atacante consegue reunir informações que facilitam outros ataques ou violam privacidade.

Exemplo

Um endpoint retorna 'Usuário não encontrado no banco de dados' em vez de apenas 'Credenciais inválidas', permitindo que alguém enumere usuários válidos; ou a aplicação deixa tokens JWT em cookies acessíveis ao JavaScript malicioso; ou logs de erro com stack traces são servidos publicamente.

Como mitigar

Sanitize mensagens de erro (respostas genéricas ao usuário final, logs detalhados apenas em backend seguro); revise headers HTTP (remova versões de software, X-Powered-By); nunca armazene segredos em código-fonte, variáveis de ambiente ou comentários; implemente rotação e expiração de tokens; configure logs com controle de acesso restrito e sem dados sensíveis em strings de debug.

CVE-2023-25954MEDIUMKYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 EPSS 0.3%CVE-2026-34780HIGHElectron: Context Isolation bypass via contextBridge VideoFrame transferEPSS 0.3%CVE-2026-54497MEDIUMview_component: Reused Component Instances Retain Stale Render ContextEPSS 0.3%CVE-2020-12020—Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative EPSS 0.3%CVE-2025-6788MEDIUMA CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providEPSS 0.3%CVE-2025-32783MEDIUMXWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wikiEPSS 0.3%CVE-2024-29905HIGHDIRAC: Unauthorized users can read proxy contents during generationEPSS 0.3%CVE-2026-46723MEDIUMInformation Disclosure in extension "Faceted Search" (ke_search)EPSS 0.3%CVE-2023-49342MEDIUMTemporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2019-3682HIGHInsecure API port exposed to all Master Node guest containersEPSS 0.3%CVE-2026-41369HIGHOpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host ExecutionEPSS 0.3%CVE-2023-49347MEDIUMTemporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data EPSS 0.3%CVE-2026-54495MEDIUMCross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clustersEPSS 0.3%CVE-2026-34765MEDIUMElectron named window.open targets not scoped to the opener's browsing contextEPSS 0.3%CVE-2026-44552HIGHOpen WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache PoisoningEPSS 0.3%CVE-2026-34217MEDIUMSandboxJS has a Sandbox Escape via Prop Object Leak in New HandlerEPSS 0.3%CVE-2023-49343MEDIUMTemporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is EPSS 0.3%CVE-2023-49344MEDIUMTemporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. TheEPSS 0.3%CVE-2023-49345MEDIUMTemporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2023-49346MEDIUMTemporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The datEPSS 0.3%