Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2023-38845—An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.EPSS 1.0%CVE-2023-38847—An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.EPSS 1.0%CVE-2025-53136MEDIUMNT OS Kernel Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-47529MEDIUMWordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data ExposureEPSS 1.0%CVE-2024-42222MEDIUMApache CloudStack: Unauthorised Network List AccessEPSS 1.0%CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2007-3651MEDIUMclass/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) EPSS 1.0%CVE-2022-30197MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-41271MEDIUMCache poisoning via maliciously-formed request in discourseEPSS 1.0%CVE-2022-32740LOWInformation disclosure in the External InterfaceEPSS 1.0%CVE-2025-24253CRITICALThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 1EPSS 1.0%CVE-2025-24246CRITICALAn injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 1.0%CVE-2025-24250CRITICALThis issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13EPSS 1.0%CVE-2019-0048MEDIUMEX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may failEPSS 1.0%CVE-2023-36908MEDIUMWindows Hyper-V Information Disclosure VulnerabilityEPSS 1.0%CVE-2022-24782MEDIUMSecure category names leaked via user activity export in DiscourseEPSS 1.0%CVE-2023-42387—An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function EPSS 1.0%CVE-2023-1584HIGHQuarkus-oidc: id and access tokens leak via the authorization code flowEPSS 1.0%CVE-2022-32818MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5. An app may be able to leak sensitive kernEPSS 1.0%CVE-2013-10007MEDIUMethitter WP-Print-Friendly wp-print-friendly.php information disclosureEPSS 1.0%