Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2022-20680MEDIUMCisco Prime Service Catalog Information Disclosure VulnerabilityEPSS 1.1%CVE-2021-22770—A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensitive information to anEPSS 1.1%CVE-2025-10093MEDIUMD-Link DIR-852 Device Configuration getcfg.php phpcgi_main information disclosureEPSS 1.1%CVE-2023-49068—Apache DolphinScheduler: Information Leakage VulnerabilityEPSS 1.1%CVE-2018-16866MEDIUMAn out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attackerEPSS 1.1%CVE-2024-43610HIGHCopilot Studio Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-35934MEDIUMyt-dlp File Downloader cookie leakEPSS 1.0%CVE-2017-20110MEDIUMTeleopti WFM Administration Credentials information disclosureEPSS 1.0%CVE-2020-35167MEDIUMDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable TimEPSS 1.0%CVE-2023-40023MEDIUMYaklang Plugin's Fuzztag Component Allows Unauthorized Local File ReadingEPSS 1.0%CVE-2025-11368MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information ExposureEPSS 1.0%CVE-2022-32984HIGHBTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sEPSS 1.0%CVE-2024-28849MEDIUMProxy-Authorization header kept across hosts in follow-redirectsEPSS 1.0%CVE-2022-23469LOWAuthorization header displayed in the debug logsEPSS 1.0%CVE-2022-42852MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPaEPSS 1.0%CVE-2024-26470HIGHA host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackeEPSS 1.0%CVE-2020-11033MEDIUMAble to read any token through API user endpoint in GLPIEPSS 1.0%CVE-2022-25594MEDIUMMicroprogram parking lot management system - Exposure of Sensitive Information to an Unauthorized ActorEPSS 1.0%CVE-2023-4061MEDIUMWildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actorEPSS 1.0%CVE-2019-15592—GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associatEPSS 1.0%