Weaknesses of type CWE-200

4,915 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-1999-0632HIGHThe RPC portmapper service is running.EPSS 1.0%CVE-2019-18332—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2021-31918—A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stackEPSS 1.0%CVE-2021-34774MEDIUMCisco Common Services Platform Collector Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-42907MEDIUMWindows Shell Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-47655MEDIUMMicrosoft Graph Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-49159MEDIUMMicrosoft Graph Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-32151MEDIUMWindows Shell Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-40374MEDIUMMicrosoft Power Automate Desktop Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-66301MEDIUMMicrosoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-45236MEDIUMPredictable TCP ISNs in EDK II Network PackageEPSS 1.0%CVE-2024-22275MEDIUMThe vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance sheEPSS 1.0%CVE-2022-42852MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPaEPSS 1.0%CVE-2020-35167MEDIUMDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable TimEPSS 1.0%CVE-2025-49671MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-34589HIGHBender Charge Controller: RFID leakEPSS 1.0%CVE-2020-36532MEDIUMKlapp App Authorization Credentials information disclosureEPSS 1.0%CVE-2025-31279CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.EPSS 1.0%CVE-2021-22001—In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request oEPSS 1.0%CVE-2022-29567MEDIUMPossible information disclosure inside TreeGrid component with default data providerEPSS 1.0%