Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2020-11059CRITICALExposure of Sensitive Information to an Unauthorized Actor in AEgirEPSS 1.1%CVE-2023-3705HIGHInformation Disclosure Vulnerability in CP-Plus Network Video RecorderEPSS 1.1%CVE-2017-20007MEDIUMInformation Exposure in INGEPAC DA AUEPSS 1.1%CVE-2026-78851MEDIUMDirectory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtenEPSS 1.1%CVE-2021-41124HIGHSplash authentication credentials potentially leaked to target websites in scrapy-splashEPSS 1.1%CVE-2025-34130HIGHLILIN DVR Arbitrary File Read via net_html.cgiEPSS 1.1%CVE-2025-1595MEDIUMAnhui Xufan Information Technology EasyCVR getbaseconfig information disclosureEPSS 1.1%CVE-2021-0210MEDIUMJunos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active sessionEPSS 1.1%CVE-2021-32716MEDIUMInternal hidden fields are visible on to many associations in admin apiEPSS 1.1%CVE-2021-22134—A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. EPSS 1.1%CVE-2022-27863MEDIUMWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Sensitive Data Exposure vulnerabilityEPSS 1.1%CVE-2026-29066MEDIUMArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLIEPSS 1.1%CVE-2022-31060MEDIUMBanner topic data is exposed on login-required Discourse sitesEPSS 1.1%CVE-2022-23984LOWWordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information DisclosureEPSS 1.1%CVE-2022-30598—A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise haEPSS 1.1%CVE-2020-3193MEDIUMCisco Prime Collaboration Provisioning Information Disclosure VulnerabilityEPSS 1.1%CVE-2024-45811MEDIUMserver.fs.deny bypassed when using ?import&raw in viteEPSS 1.1%CVE-2025-3508MEDIUMCertain HP DesignJet products – Information disclosureEPSS 1.1%CVE-2017-0881—An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server beforEPSS 1.1%CVE-2022-48258MEDIUMIn Eternal Terminal 6.2.1, etserver and etclient have world-readable logfiles.EPSS 1.1%