Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-31380MEDIUMSRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive informationEPSS 1.1%CVE-2017-2654LOWjenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dyEPSS 1.1%CVE-2021-4024—A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spaEPSS 1.1%CVE-2025-43362CRITICALThe issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An app may be able to mEPSS 1.1%CVE-2021-32712MEDIUMInformation leakage in Error HandlerEPSS 1.1%CVE-2024-37325HIGHAzure Science Virtual Machine (DSVM) Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2019-5465—An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosEPSS 1.1%CVE-2020-3472MEDIUMCisco Webex Meetings User Email Address Information Disclosure VulnerabilityEPSS 1.1%CVE-2023-6076MEDIUMPHPGurukul Restaurant Table Booking System Reservation Status booking-details.php information disclosureEPSS 1.1%CVE-2023-33165MEDIUMMicrosoft SharePoint Server Security Feature Bypass VulnerabilityEPSS 1.1%CVE-2022-23498HIGHWhen query caching is enabled in Grafana users can query another users sessionEPSS 1.1%CVE-2022-23619MEDIUMInformation exposure in xwiki-platformEPSS 1.1%CVE-2023-34134—Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to reaEPSS 1.1%CVE-2017-20194MEDIUMFormidable Form Builder < 2.05.03 - Unauthenticated Information DisclosureEPSS 1.1%CVE-2024-21147HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotEPSS 1.1%CVE-2022-24837MEDIUMEnumerable upload file names in hedgedocEPSS 1.1%CVE-2018-11728MEDIUMThe libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attaEPSS 1.1%CVE-2018-11727MEDIUMThe libfsntfs_attribute_read_from_mft function in libfsntfs_attribute.c in libfsntfs through 2018-04-20 allows remote attackers to cause an EPSS 1.1%CVE-2024-33575MEDIUMWordPress User Meta plugin <= 3.0 - Sensitive Data Exposure vulnerabilityEPSS 1.1%CVE-2024-26177MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.1%