Weaknesses of type CWE-200

5,714 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2023-42781—Apache Airflow: Permission verification bypass allows viewing dagruns of other dagsEPSS 1.7%CVE-2021-41092MEDIUMDocker CLI leaks private registry credentials to registry-1.docker.ioEPSS 1.7%CVE-2022-24737MEDIUMExposure of Sensitive Information to an Unauthorized Actor in httpieEPSS 1.7%CVE-2024-54961MEDIUMNagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying theEPSS 1.6%CVE-2025-6984HIGHSensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchainEPSS 1.6%CVE-2021-21424MEDIUMPrevent user enumeration using Guard or the new Authenticator-based SecurityEPSS 1.6%CVE-2022-41876HIGHezplatform-graphql GraphQL queries can expose password hashesEPSS 1.6%CVE-2024-13609MEDIUM1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.phpEPSS 1.6%CVE-2018-13289MEDIUMInformation exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers tEPSS 1.6%CVE-2003-20001MEDIUMAn issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the login wait time and an eEPSS 1.6%CVE-2020-3498MEDIUMCisco Jabber for Windows Information Disclosure VulnerabilityEPSS 1.6%CVE-2023-41752HIGHApache Traffic Server: s3_auth plugin problem with hash calculationEPSS 1.6%CVE-2022-0709—Booking Package < 1.5.29 - Unauthenticated Sensitive Data DisclosureEPSS 1.6%CVE-2020-1757HIGHA flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unEPSS 1.6%CVE-2017-2651LOWjenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamicallyEPSS 1.6%CVE-2025-21242MEDIUMWindows Kerberos Information Disclosure VulnerabilityEPSS 1.6%CVE-2025-24011MEDIUMUmbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response CodesEPSS 1.6%CVE-2020-36723MEDIUMListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information DisclosureEPSS 1.6%CVE-2023-45348—Apache Airflow: Configuration information leakage vulnerabilityEPSS 1.6%CVE-2018-14782—NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allows access to configuration filEPSS 1.6%