Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2022-25602HIGHWordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerabilityEPSS 1.3%CVE-2018-16477—A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposEPSS 1.3%CVE-2018-13290MEDIUMInformation exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users tEPSS 1.3%CVE-2018-13292MEDIUMInformation exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticaEPSS 1.3%CVE-2022-24867HIGHLDAP password exposure in glpiEPSS 1.3%CVE-2022-23067HIGHToolJet - Token Leakage via Referer HeaderEPSS 1.3%CVE-2014-0778—Progea Movicon SCADA Exposure of Sensitive Information to an Unauthorized ActorEPSS 1.3%CVE-2020-3391MEDIUMCisco Digital Network Architecture Center Information Disclosure VulnerabilityEPSS 1.3%CVE-2019-3992—ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the serverEPSS 1.3%CVE-2023-26049LOWCookie parsing of quoted values can exfiltrate values from other cookies in Eclipse JettyEPSS 1.3%CVE-2022-0813MEDIUMPhpMyAdmin exposure of sensitive informationEPSS 1.3%CVE-2020-1628MEDIUMJunos OS: EX4300: Traffic from the network internal to the device (128.0.0.0) may be forwarded to egress interfacesEPSS 1.3%CVE-2023-42846—This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS EPSS 1.3%CVE-2017-6709—A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access adminisEPSS 1.3%CVE-2022-0430LOWExposure of Sensitive Information to an Unauthorized Actor in httpie/httpieEPSS 1.3%CVE-2021-21435MEDIUMInformation exposure in PDF exportEPSS 1.3%CVE-2018-13294MEDIUMInformation exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated usEPSS 1.3%CVE-2018-13295MEDIUMInformation exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authentEPSS 1.3%CVE-2016-6539—TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device IDEPSS 1.3%CVE-2026-53598HIGHPrompty: Arbitrary File Read via ${file:path} Reference ExpansionEPSS 1.3%