Falhas do tipo CWE-88

378 resultados

Divulgação de Informações

Falha que permite que dados sensíveis (senhas, tokens, chaves, dados pessoais) sejam expostos a usuários ou atacantes que não deveriam ter acesso. O código não implementa controles adequados de acesso ou deixa informações sensíveis visíveis em logs, mensagens de erro, respostas HTTP ou memória.

Exemplo

Um servidor retorna mensagens de erro detalhadas que revelam estrutura do banco de dados, caminhos de arquivos ou nomes de usuários válidos. Ou uma API expõe dados de usuários em resposta JSON sem validar permissões, permitindo qualquer cliente listar informações alheias.

Como mitigar

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para não expor detalhes internos, revise logs e respostas da API antes de enviar ao cliente, criptografe dados em repouso e em trânsito. Teste regularmente com ferramentas de fuzzing e análise de dados expostos.

CVE-2025-29768MEDIUMVim vulnerable to potential data loss with zip.vim and special crafted zip filesEPSS 0.4%CVE-2025-40948MEDIUMA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEEPSS 0.4%CVE-2025-27146LOWMatrix IRC Bridge allows IRC command injection to own puppeted userEPSS 0.4%CVE-2020-1738LOWA flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task iEPSS 0.4%CVE-2026-43941CRITICALUnvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link clickEPSS 0.4%CVE-2026-90467MEDIUMaiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addressesEPSS 0.4%CVE-2025-12613HIGHVersions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values cEPSS 0.4%CVE-2023-0633HIGHIn Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPEEPSS 0.4%CVE-2026-110859HIGHGitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NameEPSS 0.4%CVE-2026-74237HIGHGFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf ClientEPSS 0.4%CVE-2026-84256HIGHAn argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to exEPSS 0.4%CVE-2025-47421HIGHPrivilege escalation via SCP loginEPSS 0.4%CVE-2026-79685MEDIUMDell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vEPSS 0.4%CVE-2026-44450CRITICALLumiverse: RCE via MCP stdio argument injectionEPSS 0.4%CVE-2023-22631LOWPRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.EPSS 0.4%CVE-2023-22632LOWPRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.EPSS 0.4%CVE-2026-53783HIGHrsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsyncEPSS 0.4%CVE-2026-97798HIGHWindows Error Reporting Service Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-20016MEDIUMA vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authentEPSS 0.4%CVE-2026-48116HIGHAnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skillEPSS 0.4%