Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2022-31162HIGHSlack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logsEPSS 0.9%CVE-2023-40275CRITICALAn issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/searchEPSS 0.9%CVE-2022-40194MEDIUMWordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerabilityEPSS 0.9%CVE-2017-16007—node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based serversEPSS 0.9%CVE-2026-57205MEDIUMSimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpointsEPSS 0.9%CVE-2022-23497MEDIUMInsecure file access in FreshRSSEPSS 0.9%CVE-2021-39220LOWBypass of image blocking in Nextcloud MailEPSS 0.9%CVE-2026-40379CRITICALAzure Entra ID Spoofing VulnerabilityEPSS 0.9%CVE-2023-50715MEDIUMUser accounts disclosed to unauthenticated actors on the LANEPSS 0.9%CVE-2021-23890MEDIUMMcAfee ePO Information Leak vulnerabilityEPSS 0.9%CVE-2022-25248MEDIUMPTC Axeda agent and Axeda Desktop Server Information ExposureEPSS 0.9%CVE-2026-1980MEDIUMWPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data ExposureEPSS 0.9%CVE-2025-11079MEDIUMCampcodes Farm Management System file information disclosureEPSS 0.9%CVE-2022-22542—S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise SEPSS 0.9%CVE-2026-42878MEDIUMFacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScriptsEPSS 0.9%CVE-2020-10274HIGHRVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)EPSS 0.9%CVE-2020-1777MEDIUMAgent names disclosed in chat featureEPSS 0.9%CVE-2025-7874MEDIUMMetasoft 美特软件 MetaCRM env.jsp information disclosureEPSS 0.9%CVE-2022-34329MEDIUMIBM CICS TX information disclosureEPSS 0.9%CVE-2021-33709—A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versionEPSS 0.9%