Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-32731MEDIUMThe reset password form reveal users email addressEPSS 1.2%CVE-2024-8852MEDIUMAll-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error LogsEPSS 1.2%CVE-2019-1692MEDIUMCisco Application Policy Infrastructure Controller Web-Based Management Interface Usage Information Disclosure VulnerabilityEPSS 1.2%CVE-2023-43796MEDIUMSynapse vulnerable to leak of remote user device informationEPSS 1.2%CVE-2023-40029CRITICALCluster secret might leak in cluster details page in Argo CDEPSS 1.2%CVE-2019-7005MEDIUMUnauthenticated Information Disclosure Vulnerability in IP OfficeEPSS 1.2%CVE-2024-46437MEDIUMA sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote aEPSS 1.2%CVE-2023-48796—Apache dolphinscheduler sensitive information disclosureEPSS 1.2%CVE-2023-39999MEDIUMWordPress < 6.3.2 is vulnerable to Broken Access ControlEPSS 1.2%CVE-2026-55450CRITICALLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakEPSS 1.2%CVE-2018-13291MEDIUMInformation exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenEPSS 1.2%CVE-2021-22137—In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. SearcEPSS 1.2%CVE-2021-29086MEDIUMExposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.EPSS 1.2%CVE-2018-13281MEDIUMInformation exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated useEPSS 1.2%CVE-2021-24585—Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username DisclosureEPSS 1.2%CVE-2022-1186MEDIUMBe POPIA Compliant <= 1.1.5 - Sensitive Information ExposureEPSS 1.2%CVE-2022-0722MEDIUMExposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-urlEPSS 1.2%CVE-2024-6633CRITICALInsecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)EPSS 1.2%CVE-2023-28271MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 1.2%CVE-1999-0632MEDIUMThe RPC portmapper service is running.EPSS 1.2%