Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-22913—Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server EPSS 1.4%CVE-2022-4228MEDIUMSourceCodester Book Store Management System information disclosureEPSS 1.4%CVE-2021-22912—Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by defauEPSS 1.4%CVE-2022-26885HIGHApache DolphinScheduler config file read by task riskEPSS 1.4%CVE-2018-10859MEDIUMgit-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex intoEPSS 1.4%CVE-2021-20281—It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.EPSS 1.4%CVE-2023-43804MEDIUM`Cookie` HTTP header isn't stripped on cross-origin redirectsEPSS 1.4%CVE-2022-27667—Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacEPSS 1.4%CVE-2021-32711CRITICALLeak of information via Store-APIEPSS 1.4%CVE-2022-29248HIGHCross-domain cookie leakage in GuzzleEPSS 1.4%CVE-2023-38158LOWMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 1.3%CVE-2020-7506—A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unEPSS 1.3%CVE-2022-2221—Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users tEPSS 1.3%CVE-2021-22135—Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API EPSS 1.3%CVE-2024-29291—An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE:EPSS 1.3%CVE-2026-20847MEDIUMMicrosoft Windows File Explorer Spoofing VulnerabilityEPSS 1.3%CVE-2022-31112HIGHProtected fields exposed via LiveQuery in parse-serverEPSS 1.3%CVE-2016-7047MEDIUMA flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability wEPSS 1.3%CVE-2022-31130MEDIUMGrafana data source and plugin proxy endpoints leaking authentication tokens to some destination pluginsEPSS 1.3%CVE-2018-1090MEDIUMIn Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with reaEPSS 1.3%