Weaknesses of type CWE-200

4,959 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2026-46443HIGHFlowise: Credential Data LeakEPSS 0.4%CVE-2025-8738MEDIUMzlt2000 microservices-platform Spring Actuator Interface actuator information disclosureEPSS 0.4%CVE-2025-13785MEDIUMyungifez Skuul School Management System Image profile information disclosureEPSS 0.4%CVE-2026-0950MEDIUMSpectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive DataEPSS 0.4%CVE-2026-29872HIGHA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab82EPSS 0.4%CVE-2021-43937HIGHElcomplus SmartPTT SCADA Server Cross-site Request ForgeryEPSS 0.4%CVE-2026-59130MEDIUMAMD Zen Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-1197LOWMineAdmin downloadById information disclosureEPSS 0.4%CVE-2024-1952LOWMattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing anEPSS 0.4%CVE-2017-12289—A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local attEPSS 0.4%CVE-2025-54133MEDIUMCursor's MCP Install Deeplink Does Not Show Arguments in its User-DialogEPSS 0.4%CVE-2024-12560MEDIUMButton Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post DuplicationEPSS 0.4%CVE-2024-39313MEDIUMtoy-blog Improper Input Validation vulnerabilityEPSS 0.4%CVE-2020-3347MEDIUMCisco Webex Meetings Desktop App for Windows Shared Memory Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-34969LOWNhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider CallbackEPSS 0.4%CVE-2025-46279CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.EPSS 0.4%CVE-2025-60449MEDIUMAn information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component locatedEPSS 0.4%CVE-2026-18068MEDIUMIBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets ExtensionEPSS 0.4%CVE-2026-34087MEDIUMUsers API leaks whether privileged users have their user groups disabled for lack of 2FAEPSS 0.4%CVE-2024-12159MEDIUMOptimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information ExposureEPSS 0.4%