Weaknesses of type CWE-200

4,941 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2024-8106MEDIUMThe Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information ExposureEPSS 0.5%CVE-2025-49200MEDIUMUnencrypted backup contains sensitive informationEPSS 0.5%CVE-2025-14198MEDIUMVerysync 微力同步 Web Administration download information disclosureEPSS 0.5%CVE-2025-32703MEDIUMVisual Studio Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-45300HIGHasync-http-client: Cookie header not stripped on cross-origin redirectEPSS 0.5%CVE-2024-34368MEDIUMWordPress Mooberry Book Manager plugin <= 4.15.12 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2024-7391LOWChargePoint Home Flex Bluetooth Low Energy Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-44877MEDIUMUnauthenticated Remote Disclosure of Cryptographic SecretsEPSS 0.5%CVE-2025-55679MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-49274LOWUmbraco CMS SMTP misconfiguration exposes potential registered user emailEPSS 0.5%CVE-2025-31191MEDIUMThis issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS SonomEPSS 0.5%CVE-2023-34243MEDIUMWindows user name disclosure in TGstationEPSS 0.5%CVE-2026-47701HIGHOpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authEPSS 0.5%CVE-2023-30740MEDIUMInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.5%CVE-2026-56322HIGHCapgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterEPSS 0.5%CVE-2026-30866HIGHCombodo iTop: Insecured access to uploaded images via sniffed urlEPSS 0.5%CVE-2025-32080MEDIUMCross-origin data leak in mobilefrontend via lazy load imagesEPSS 0.5%CVE-2026-56303HIGHCapgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionEPSS 0.5%CVE-2026-49742HIGHTYPO3 CMS - Broken Access Control in Media ModuleEPSS 0.5%CVE-2026-56300HIGHCapgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsEPSS 0.5%