Weaknesses of type CWE-200

5,714 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2024-52323HIGHSensitive Data ExposureEPSS 1.5%CVE-2023-5070MEDIUMSocial Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information ExposureEPSS 1.5%CVE-2021-32717HIGHPrivate files publicly accessible with Cloud Storage providersEPSS 1.5%CVE-2026-6826MEDIUMConcrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controllerEPSS 1.5%CVE-2022-23948HIGHA flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously createdEPSS 1.5%CVE-2018-10852LOWThe UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone EPSS 1.5%CVE-2022-40691MEDIUMAn information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. EPSS 1.5%CVE-2021-21376MEDIUMInformation Exposure in OMERO.webEPSS 1.5%CVE-2017-6708—A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allowEPSS 1.5%CVE-2021-39164LOWImproper authorisation of /members discloses room membership to non-membersEPSS 1.5%CVE-2019-1657MEDIUMCisco AMP Threat Grid API Key Information Disclosure VulnerabilityEPSS 1.5%CVE-2020-7819CRITICALnTracker USB Enterprise SQL-Injection vulnerabilityEPSS 1.5%CVE-2020-10291HIGHRVD#3336: System information disclosure without authentication on KUKA simulatorsEPSS 1.4%CVE-2018-1074HIGHovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentialEPSS 1.4%CVE-2017-12080—An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allEPSS 1.4%CVE-2018-8919HIGHInformation exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote aEPSS 1.4%CVE-2021-3677—A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authentEPSS 1.4%CVE-2023-42780—Apache Airflow: Improper access control vulnerability in the "List dag warnings" featureEPSS 1.4%CVE-2021-24163—Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key DisclosureEPSS 1.4%CVE-2019-1877MEDIUMCisco Enterprise Chat and Email Attachment Download VulnerabilityEPSS 1.4%