Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2019-15592—GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associatEPSS 1.0%CVE-2022-41707MEDIUMRelatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. TEPSS 1.0%CVE-2022-24784LOWDiscoverability of user password hash in Statamic CMSEPSS 1.0%CVE-2021-21301LOWVideo feed was captured while user has disabled videoEPSS 1.0%CVE-2022-22183HIGHJunos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.EPSS 1.0%CVE-2021-32473—It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to EPSS 1.0%CVE-2021-4377MEDIUMDoneren met Mollie <= 2.8.4 - Information DisclosureEPSS 1.0%CVE-2019-15579—An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where thEPSS 1.0%CVE-2018-25081HIGHBitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have beEPSS 1.0%CVE-2024-21501MEDIUMVersions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attriEPSS 1.0%CVE-2026-47633HIGHMicrosoft Cost Management Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-26054MEDIUMCredentials inlined to Git URLs could end up in provenance attestation in BuildKitEPSS 1.0%CVE-2025-59284LOWWindows NTLM Spoofing VulnerabilityEPSS 1.0%CVE-2019-18334—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2019-18331—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2026-53959MEDIUM4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated userEPSS 1.0%CVE-2019-18335—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2019-18333—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2022-43959MEDIUMInsufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to EPSS 1.0%CVE-2026-45793HIGHComposer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logsEPSS 1.0%