Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-25110—Futurio Extra < 1.6.3 - Subscriber+ User Email Address DisclosureEPSS 0.9%CVE-2021-39163LOWAdding a private/unlisted room to a community exposes room metadata in an unauthorised manner.EPSS 0.9%CVE-2017-15138MEDIUMThe OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidentiaEPSS 0.9%CVE-2022-35296—Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive iEPSS 0.9%CVE-2022-42817MEDIUMA logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, watEPSS 0.9%CVE-2017-12310—A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sEPSS 0.9%CVE-2023-6101MEDIUMMaiwei Safety Production Control Platform Intelligent Monitoring ha.html information disclosureEPSS 0.9%CVE-2024-1139HIGHCluster-monitoring-operator: credentials leakEPSS 0.9%CVE-2022-41859HIGHIn freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantiallEPSS 0.9%CVE-2024-23321HIGHApache RocketMQ: Unauthorized Exposure of Sensitive DataEPSS 0.9%CVE-2021-24164—Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key DisclosureEPSS 0.9%CVE-2023-0321CRITICALDisclosure of Sensitive Information on Campbell Scientific ProductsEPSS 0.9%CVE-2022-31143MEDIUMLeak of sensitive information through login page error in GLPIEPSS 0.9%CVE-2023-5576HIGHMigration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret ExposureEPSS 0.9%CVE-2023-7094MEDIUMNetentsec NS-ASG Application Security Gateway nsasg6.0.tgz information disclosureEPSS 0.9%CVE-2023-40049MEDIUMWS_FTP Server Information Disclosure via Directory ListingEPSS 0.9%CVE-2026-48050HIGHArc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSEPSS 0.9%CVE-2025-30474MEDIUMApache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error messageEPSS 0.9%CVE-2026-21532HIGHAzure Function Information Disclosure VulnerabilityEPSS 0.9%CVE-2024-3689LOWZhejiang Land Zongheng Network Technology O2OA information disclosureEPSS 0.9%