Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2022-31134MEDIUMZulip Server public data export contains attachments that are non-publicEPSS 0.9%CVE-2021-42536HIGHEmerson WirelessHART GatewayEPSS 0.9%CVE-2024-21140MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotEPSS 0.9%CVE-2025-27736MEDIUMWindows Power Dependency Coordinator Information Disclosure VulnerabilityEPSS 0.9%CVE-2023-39620—An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via thEPSS 0.9%CVE-2022-27614MEDIUMExposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remEPSS 0.9%CVE-2022-42818MEDIUMThis issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. A user in a privileged network position mayEPSS 0.9%CVE-2022-31068MEDIUMSensitive Data Exposure on Refused Inventory Files in GLPIEPSS 0.9%CVE-2022-27630MEDIUMAn information disclosure vulnerability exists in the confctl_get_master_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A spEPSS 0.9%CVE-2022-27633MEDIUMAn information disclosure vulnerability exists in the confctl_get_guest_wlan functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specEPSS 0.9%CVE-2024-34788MEDIUMAn improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially senEPSS 0.9%CVE-2022-32741MEDIUMInformation disclosure in Request New Password featureEPSS 0.9%CVE-2023-5254MEDIUMAI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_userEPSS 0.9%CVE-2019-15963MEDIUMCisco Unified Communications Manager Information Disclosure VulnerabilityEPSS 0.9%CVE-2023-0557HIGHContentStudio <= 1.2.5 - Information ExposureEPSS 0.9%CVE-2022-2907MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 beforeEPSS 0.9%CVE-2026-0717MEDIUMLottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information ExposureEPSS 0.9%CVE-2019-17321—ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated with session, couldEPSS 0.9%CVE-2022-39030HIGHSmart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2EPSS 0.9%CVE-2023-41321MEDIUMSensitive fields enumeration through API in GLPIEPSS 0.9%