Weaknesses of type CWE-200

4,939 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2026-95703MEDIUMMISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_nameEPSS 0.5%CVE-2025-31124MEDIUMZitadel allows User Enumeration by loginname attribute normalizationEPSS 0.5%CVE-2026-73406HIGHBudibase: Unauthenticated user information disclosure via public tenant user lookup endpointEPSS 0.5%CVE-2026-49256MEDIUMDiscourse: Hidden tag names leaked via category serializersEPSS 0.5%CVE-2026-58419HIGHNotification API leaks private issue metadata after access revocationEPSS 0.5%CVE-2020-3182MEDIUMCisco Webex Meetings Client for MacOS Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-0023MEDIUMInformation Disclosure in SAP Bank Account Management (Manage Banks)EPSS 0.5%CVE-2024-45739MEDIUMSensitive information disclosure in AdminManager logging channelEPSS 0.5%CVE-2023-39974—Extension - acymailing.com - Exposure of Sensitive Information in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.5%CVE-2023-28901MEDIUMTrip Data Disclosure from BackendEPSS 0.5%CVE-2026-52855CRITICALWings exposes node configuration secrets through egg configuration-file templatingEPSS 0.5%CVE-2023-43754MEDIUMPermalink previews displayed for posts in archived channels even if users are disallowed to view archived channelsEPSS 0.5%CVE-2026-76647HIGHLeantime JSON-RPC API contains a missing authorization vulnerabilityEPSS 0.5%CVE-2023-45223MEDIUMUsers full name disclosure through Mattermost Boards with Show Full Name Option disabledEPSS 0.5%CVE-2022-2739—The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman EPSS 0.5%CVE-2026-14503MEDIUMpCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File ReadEPSS 0.5%CVE-2026-45267MEDIUMNextcloud: Missing permission check for from submissionsEPSS 0.5%CVE-2026-48001LOWAdobe Commerce | Information Exposure (CWE-200)EPSS 0.5%CVE-2026-49807MEDIUMWindows DirectX Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-39896HIGHDirectus allows SSO User EnumerationEPSS 0.5%