Weaknesses of type CWE-200

4,975 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2025-0227MEDIUMTsinghua Unigroup Electronic Archives System downLoad.html information disclosureEPSS 0.3%CVE-2026-87541MEDIUMInformation leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process toEPSS 0.3%CVE-2025-46676LOWDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 releaseEPSS 0.3%CVE-2026-58036LOWUsers API leaks whether privileged users have their user groups disabled for lack of 2FAEPSS 0.3%CVE-2025-55265MEDIUMHCL Aftermarket DPC is affected by File DiscoveryEPSS 0.3%CVE-2026-44782MEDIUMDiscourse: GroupPostSerializer leaks hidden full names through reaction post associationEPSS 0.3%CVE-2026-44785MEDIUMDiscourse: Hidden reply-to post raw can be disclosed through AI explain promptsEPSS 0.3%CVE-2026-50019MEDIUMyt-dlp: File Downloader cookie leak with curlEPSS 0.3%CVE-2025-53047MEDIUMVulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21EPSS 0.3%CVE-2026-44780MEDIUMDiscourse: Category queue reviewers can read raw incoming emails from queued postsEPSS 0.3%CVE-2023-41881LOWDeleting a collaboration should also delete linked resourcesEPSS 0.3%CVE-2026-18005MEDIUMInappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-17892MEDIUMInappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-95336MEDIUMInformation leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering toEPSS 0.3%CVE-2026-79293MEDIUMInformation leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafteEPSS 0.3%CVE-2026-79075MEDIUMInformation leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain seEPSS 0.3%CVE-2024-5880MEDIUMHide My Site <= 2.2 - Unauthenticated Information ExposureEPSS 0.3%CVE-2026-79018MEDIUMInformation leak in FoldableAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craEPSS 0.3%CVE-2026-14146MEDIUMInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.3%CVE-2026-87565MEDIUMInformation leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information EPSS 0.3%