Falhas do tipo CWE-779

20 resultados

Registro excessivo de dados sensíveis

A aplicação registra em logs informações sensíveis — senhas, tokens, dados pessoais, chaves criptográficas — que não deveriam estar ali. Isso expõe dados confidenciais a qualquer pessoa com acesso aos arquivos de log, transformando um mecanismo de diagnóstico em porta de entrada para compromisso de credenciais e dados.

Exemplo

Um sistema de autenticação que escreve no log: 'Usuário admin logou com senha: s3nh@456!'. Se alguém acessar o arquivo de log (por falta de permissões, backup desprotegido ou navegação pública), captura as credenciais e consegue acesso administrativo.

Como mitigar

Nunca registre senhas, tokens de API, chaves ou dados pessoais em logs. Implemente regras de sanitização (mascaramento de dados sensíveis antes de escrever) e revise regularmente o que está sendo logado. Use estrutura centralizada de logs com acesso controlado e retenção limitada.

CVE-2024-36416HIGHSuiteCRM v4 API Excessive log data DOSEPSS 2.0%CVE-2024-36072CRITICALNetwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logginEPSS 1.0%CVE-2022-31004HIGHPotential secrets being logged to disk in CVE ServicesEPSS 0.9%CVE-2025-51397MEDIUMA stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrarEPSS 0.9%CVE-2024-55628HIGHSuricata oversized resource names utilizing DNS name compression can lead to resource starvationEPSS 0.7%CVE-2023-23949HIGHAn authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.EPSS 0.6%CVE-2022-25779MEDIUMInsufficient scope checks allows adding unrelated audit log entriesEPSS 0.5%CVE-2025-8696HIGHDoS attack against the Stork UI from an unauthenticated userEPSS 0.4%CVE-2026-28718MEDIUMDenial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber ProtectEPSS 0.3%CVE-2025-69230LOWAIOHTTP Vulnerable to Cookie Parser Warning StormEPSS 0.3%CVE-2025-53636MEDIUMOpen OnDemand Shell App closed websocket DoSEPSS 0.3%CVE-2021-25422—Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak WEPSS 0.2%CVE-2021-25423—Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak EPSS 0.2%CVE-2021-25421—Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak EPSS 0.2%CVE-2021-25420—Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak WEPSS 0.2%CVE-2024-1141MEDIUMGlance-store: glance store access key logged in debug log levelEPSS 0.2%CVE-2026-20209MEDIUMCisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-20210MEDIUMCisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityEPSS 0.2%CVE-2022-39874MEDIUMSensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.EPSS 0.2%CVE-2022-22291MEDIUMLogging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get Cell Location InformEPSS 0.1%