Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2020-1775LOWInformation disclosure in external interfaceEPSS 0.9%CVE-2022-2939MEDIUMWP Cerber Security <= 9.0 - User Enumeration BypassEPSS 0.9%CVE-2023-41259—Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in EPSS 0.9%CVE-2021-32695LOWMalicious Android app could access Shared Preferences of the Nextcloud Android clientEPSS 0.9%CVE-2021-32720MEDIUMList of order ids, number, items total and token value exposed for unauthorized uses via new APIEPSS 0.9%CVE-2021-41123MEDIUMExposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dllEPSS 0.9%CVE-2021-3566—Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file tEPSS 0.9%CVE-2022-24849MEDIUMContact to DisCatSharp-owned server using authenticated clientEPSS 0.9%CVE-2021-39224LOWFile path disclosure of shared files in OfficeOnline applicationEPSS 0.9%CVE-2020-3547MEDIUMCisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-47282MEDIUMGitHub Copilot and Visual Studio Code Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-39307MEDIUMGrafana subject to Exposure of Sensitive Information resulting in User enumeration via forget passwordEPSS 0.9%CVE-2026-87820MEDIUMCyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI ScannerEPSS 0.9%CVE-2021-1562MEDIUMCisco BroadWorks Application Server Information Disclosure VulnerabilityEPSS 0.9%CVE-2021-34702MEDIUMCisco Identity Services Engine Sensitive Information Disclosure VulnerabilityEPSS 0.9%CVE-2020-4079HIGHInformation disclosure vulnerability in iTopEPSS 0.9%CVE-2024-11961MEDIUMGuangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosureEPSS 0.9%CVE-2025-47997MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 0.9%CVE-2023-24069—Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages froEPSS 0.9%CVE-2023-41260—Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API callEPSS 0.9%