Weaknesses of type CWE-200

4,979 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2025-67805MEDIUMA non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor featurEPSS 0.3%CVE-2026-1060MEDIUMWP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST APIEPSS 0.3%CVE-2025-4526MEDIUMDígitro NGC Explorer Configuration missing password field maskingEPSS 0.3%CVE-2020-3520MEDIUMCisco Data Center Network Manager Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-46395CRITICALHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC ImplementationEPSS 0.3%CVE-2024-20491MEDIUMCisco Nexus Dashboard Insights Information Disclosure VulnerabilityEPSS 0.3%CVE-2018-15407—Cisco HyperFlex World-Readable Sensitive Information VulnerabilityEPSS 0.3%CVE-2026-96606MEDIUMLB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosureEPSS 0.3%CVE-2026-100906MEDIUMEyeplus ONVIF Device GetUsers information disclosureEPSS 0.3%CVE-2026-100907MEDIUMEyeplus p2pcam Service snapshot information disclosureEPSS 0.3%CVE-2026-96774MEDIUMSPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosureEPSS 0.3%CVE-2025-61750MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affecteEPSS 0.3%CVE-2024-20490MEDIUMCisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-37160MEDIUMAuthenticated Broken Access Control (BAC) in REST API Configuration ServiceEPSS 0.3%CVE-2025-12039MEDIUMBigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() ExposureEPSS 0.3%CVE-2025-57756MEDIUMContao discloses sensitive information in the front end search indexEPSS 0.3%CVE-2024-3262MEDIUMInformation exposure vulnerability in Request Tracker (RT)EPSS 0.3%CVE-2023-30853HIGHGradle Build Action data written to GitHub Actions Cache may expose secretsEPSS 0.3%CVE-2025-62158LOWFrappe had attachments made by students to their assignments of type Text set to publicEPSS 0.3%CVE-2025-55052MEDIUMCWE-200 Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.3%