Falhas do tipo CWE-778

40 resultados

Registros insuficientes em log

Ocorre quando a aplicação não registra eventos críticos de segurança (tentativas de acesso, erros de autenticação, operações sensíveis) com detalhes suficientes. Sem logs adequados, é impossível detectar ataques em tempo real, investigar incidentes ou cumprir conformidade, deixando a segurança cega.

Exemplo

Um sistema que autentica usuários mas não registra tentativas falhadas de login, deixando ataques de força bruta passarem desapercebidos. Ou uma API que modifica dados críticos sem logar quem fez a mudança, impossibilitando rastreabilidade.

Como mitigar

Implemente logs estruturados e centralizados para eventos sensíveis (autenticação, autorização, mudanças de dados, erros críticos) com timestamp, identificação do usuário/origem e contexto. Configure alertas para padrões anormais e garanta retenção e proteção dos logs contra manipulação.

CVE-2019-7613—Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entryEPSS 1.3%CVE-2019-19277—A vulnerability has been identified in SIPORT MP (All versions < 3.1.4). Vulnerable versions of the device allow the creation of special accEPSS 1.2%CVE-2019-19295MEDIUMA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) does not enforceEPSS 1.1%CVE-2026-66816MEDIUMMicrosoft SQL Server Security Feature Bypass VulnerabilityEPSS 1.0%CVE-2022-31120LOWFederated share accepting/declining is not logged in audit log in Nextcloud ServerEPSS 0.9%CVE-2026-105243MEDIUMApache log4net: Oversize EventLogAppender record silently discardedEPSS 0.8%CVE-2021-43419HIGHAn Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat app.EPSS 0.7%CVE-2026-41709LOWESX insufficient logging vulnerabilityEPSS 0.7%KEVCVE-2022-30305LOWAn insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptorEPSS 0.7%CVE-2024-48967CRITICALLife2000 ventilator and Service PC lack sufficient audit logging capabilitiesEPSS 0.6%CVE-2022-25783MEDIUMHacking attempts from logged-in users are not properly logged by GMEPSS 0.6%CVE-2021-33689LOWWhen user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version EPSS 0.5%CVE-2026-92002MEDIUMMISP: Authentication failure logging suppressed during Redis unavailabilityEPSS 0.5%CVE-2026-91859MEDIUMMISP Access Log Entry Overwritten by Error Controller's Second beforeFilter PassEPSS 0.5%CVE-2024-10863MEDIUMClient-side audit exclusion vulnerabilityEPSS 0.5%CVE-2023-1995MEDIUMInsufficient Logging Vulnerability in HiRDBEPSS 0.5%CVE-2026-76208HIGHphpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAPEPSS 0.4%CVE-2025-2562MEDIUMInsufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a storedEPSS 0.4%CVE-2026-85959HIGHInsufficient authentication logging in Progress MarkLogic ServerEPSS 0.4%CVE-2024-2291MEDIUMMOVEit Transfer Logging Bypass VulnerabilityEPSS 0.4%