Weaknesses of type CWE-200

4,915 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2020-5132—SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collisionEPSS 1.0%CVE-2023-6894MEDIUMHikvision Intercom Broadcasting System Log File system.html information disclosureEPSS 1.0%CVE-2023-22880MEDIUMInformation Disclosure in Zoom for Windows ClientsEPSS 1.0%CVE-2025-30424CRITICALA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13EPSS 1.0%CVE-2023-6757MEDIUMThecosy IceCMS API PlanetUser information disclosureEPSS 1.0%CVE-2025-3415MEDIUMGrafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected anEPSS 1.0%CVE-2024-7842MEDIUMSourceCodester Online Graduate Tracer System export_it.php information disclosureEPSS 1.0%CVE-2024-7843MEDIUMSourceCodester Online Graduate Tracer System exportcs.php information disclosureEPSS 1.0%CVE-2025-11368MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information ExposureEPSS 1.0%CVE-2023-47529MEDIUMWordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data ExposureEPSS 1.0%CVE-2022-21671HIGHPotential exposure of Replit tokens to an Unauthorized Actor in @replit/crosisEPSS 1.0%CVE-2024-42222MEDIUMApache CloudStack: Unauthorised Network List AccessEPSS 1.0%CVE-2007-3651MEDIUMclass/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) EPSS 1.0%CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2022-30197MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.0%CVE-2022-21683LOWComment reply notifications sent to incorrect users in wagtailEPSS 1.0%CVE-2021-41271MEDIUMCache poisoning via maliciously-formed request in discourseEPSS 1.0%CVE-2019-10175MEDIUMA flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determEPSS 1.0%CVE-2019-0048MEDIUMEX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may failEPSS 1.0%CVE-2022-24782MEDIUMSecure category names leaked via user activity export in DiscourseEPSS 1.0%