Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-42523—There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c sepEPSS 1.0%CVE-2021-34589HIGHBender Charge Controller: RFID leakEPSS 1.0%CVE-2021-22785HIGHA CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leEPSS 1.0%CVE-2019-11268MEDIUMUAA SQL Identity Zone VulnerabilityEPSS 1.0%CVE-2022-29241HIGHKnown or guessable hidden files may be accessed in Jupyter ServerEPSS 1.0%CVE-2021-22001—In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request oEPSS 1.0%CVE-2020-5132—SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collisionEPSS 1.0%CVE-2023-6894MEDIUMHikvision Intercom Broadcasting System Log File system.html information disclosureEPSS 1.0%CVE-2025-62206MEDIUMMicrosoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-6757MEDIUMThecosy IceCMS API PlanetUser information disclosureEPSS 1.0%CVE-2023-22880MEDIUMInformation Disclosure in Zoom for Windows ClientsEPSS 1.0%CVE-2022-40177—A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DEPSS 1.0%CVE-2022-4543MEDIUMA flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR bEPSS 1.0%CVE-2022-31032MEDIUMResources of private projects can be exposed in TuleapEPSS 1.0%CVE-2021-3644—A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressiEPSS 1.0%CVE-2025-6239MEDIUMInformation disclosureEPSS 1.0%CVE-2024-7843MEDIUMSourceCodester Online Graduate Tracer System exportcs.php information disclosureEPSS 1.0%CVE-2024-7842MEDIUMSourceCodester Online Graduate Tracer System export_it.php information disclosureEPSS 1.0%CVE-2023-38845—An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.EPSS 1.0%CVE-2023-38847—An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.EPSS 1.0%