Weaknesses of type CWE-200

5,714 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2017-16715HIGHAn Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 VersEPSS 1.7%CVE-2021-41251MEDIUMPossibility to elevate privileges or get unauthorized access to dataEPSS 1.7%CVE-2019-6850—A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the diEPSS 1.7%CVE-2018-0266—A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitiveEPSS 1.7%CVE-2019-6849—A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the diEPSS 1.7%CVE-2021-3714—A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via EPSS 1.7%CVE-2017-12295—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the applicatioEPSS 1.7%CVE-2017-2609MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autoEPSS 1.7%CVE-2025-6082MEDIUMBirth Chart Compatibility <= 2.0 - Unauthenticated Full Path ExposureEPSS 1.7%CVE-2020-15250MEDIUMInformation disclosure in JUnit4EPSS 1.7%CVE-2021-34749MEDIUMMultiple Cisco Products Server Name Identification Data Exfiltration VulnerabilityEPSS 1.7%CVE-2026-2025HIGHMail Mint < 1.19.5 - Unauthenticated Emails DisclosureEPSS 1.7%CVE-2021-30169MEDIUMMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2EPSS 1.7%CVE-2026-32315MEDIUMmotionEye: World-Readable Configuration File Exposes Admin Password HashEPSS 1.7%CVE-2022-39201MEDIUMData source and plugin proxy endpoints could leak the authentication cookie to some destination pluginsEPSS 1.7%CVE-2024-35263MEDIUMMicrosoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityEPSS 1.7%CVE-2020-26869HIGHARC Informatique PcVue Exposure of Sensitive Information to an Unauthorized ActorEPSS 1.7%CVE-2020-26230HIGHDeanonymization of COVID-19 positive users of Radar COVIDEPSS 1.7%CVE-2019-1227MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.7%CVE-2019-1228MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.7%