Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-43938HIGHElcomplus SmartPTT SCADA Server Information ExposureEPSS 1.1%CVE-2023-24838CRITICALHGiga PowerStation - Information LeakageEPSS 1.1%CVE-2021-22044—In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@ReEPSS 1.1%CVE-2022-24747MEDIUMHTTP caching is marking private HTTP headers as publicEPSS 1.1%CVE-2021-34707MEDIUMCisco Evolved Programmable Network Manager Sensitive Information Disclosure VulnerabilityEPSS 1.1%CVE-2023-34235HIGHLeaking sensitive user information still possible by filtering on private with prefix fieldsEPSS 1.1%CVE-2026-2054MEDIUMD-Link DIR-605L/DIR-619L Wifi Setting information disclosureEPSS 1.1%CVE-2026-2056MEDIUMD-Link DIR-605L/DIR-619L DHCP Connection Status wan_connection_status.asp information disclosureEPSS 1.1%CVE-2026-2055MEDIUMD-Link DIR-605L/DIR-619L DHCP Client Information information disclosureEPSS 1.1%CVE-2016-9590MEDIUMpuppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation oEPSS 1.1%CVE-2026-25185MEDIUMWindows Shell Link Processing Spoofing VulnerabilityEPSS 1.1%CVE-2021-3503—A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerabilityEPSS 1.1%CVE-2019-15257MEDIUMCisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure VulnerabilityEPSS 1.1%CVE-2021-44141—All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory existsEPSS 1.1%CVE-2019-12708MEDIUMCisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-23607MEDIUMUnsafe handling of user-specified cookies in treqEPSS 1.1%CVE-2025-3415MEDIUMGrafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected anEPSS 1.1%CVE-2022-24906LOWError in deleting deck cards attachment reveals the full application path in Nextcloud DeckEPSS 1.1%CVE-2022-29232MEDIUMExposure of messages in BigBlueButton public chatsEPSS 1.1%CVE-2023-23839MEDIUMSolarWinds Platform Exposure of Sensitive Information VulnerabilityEPSS 1.1%