Weaknesses of type CWE-200

4,941 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2026-8766MEDIUMKilo-Org kilocode Environment Variable config.ts load information disclosureEPSS 0.5%CVE-2025-56406HIGHAn issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE servEPSS 0.5%CVE-2026-53586MEDIUMlibgit2: HTTP transport can leak credentials to an offsite redirect targetEPSS 0.5%CVE-2026-33394LOWDiscourse leaks PM post edits to moderatorsEPSS 0.5%CVE-2026-12426MEDIUMMembers <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side ChannelEPSS 0.5%CVE-2024-52280HIGHUsers can issue watch commands for arbitrary resourcesEPSS 0.5%CVE-2024-33881HIGHAn issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/DownloEPSS 0.5%CVE-2024-35343CRITICALCertain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /EPSS 0.5%CVE-2023-2281LOWArchiving a team broadcasts unsanitized data over WebSocketsEPSS 0.5%CVE-2024-34005MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupEPSS 0.5%CVE-2025-61665HIGHWeGIA: Broken Access Control in `get_relatorios_socios.php` EndpointEPSS 0.5%CVE-2025-31491HIGHAutoGPT allows leakage of cross-domain cookies and protected headers in requests redirectEPSS 0.5%CVE-2025-23216MEDIUMArgo CD does not scrub secret values from patch errorsEPSS 0.5%CVE-2026-16773MEDIUMWPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX ActionEPSS 0.5%CVE-2024-23562MEDIUMHCL Domino is susceptible to an information disclosure vulnerabilityEPSS 0.5%CVE-2024-33003HIGHInformation Disclosure Vulnerability in SAP Commerce CloudEPSS 0.5%CVE-2024-34002MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupEPSS 0.5%CVE-2026-39412MEDIUMLiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channelEPSS 0.5%CVE-2026-92960CRITICALvm2 before 3.11.6 Process-wide State Exposure via os and dnsEPSS 0.5%CVE-2020-36771HIGHCloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local userEPSS 0.5%