Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2026-40374MEDIUMMicrosoft Power Automate Desktop Information Disclosure VulnerabilityEPSS 0.9%CVE-2020-14371—A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are runEPSS 0.9%CVE-2021-43823MEDIUMSide-channel attack in SourcegraphEPSS 0.9%CVE-2022-24804MEDIUMPrivate group name exposure in discourseEPSS 0.9%CVE-2014-125093MEDIUMAd Blocking Detector Plugin ad-blocking-detector.php information disclosureEPSS 0.9%CVE-2021-32624HIGHPrivate Field data leakEPSS 0.9%CVE-2019-19283—A vulnerability has been identified in XHQ (All Versions < 6.1). The application's web server could expose non-sensitive information about tEPSS 0.9%CVE-2022-32219MEDIUMAn information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter frEPSS 0.9%CVE-2021-42522—There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was caused by the incorrecEPSS 0.9%CVE-2026-50415MEDIUMWindows Media Information Disclosure VulnerabilityEPSS 0.9%CVE-2023-23613MEDIUMField-level security issue with .keyword fields in OpenSearchEPSS 0.9%CVE-2025-34272MEDIUMNagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard FallbackEPSS 0.9%CVE-2025-24146CRITICALThis issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, mEPSS 0.9%CVE-2025-43542HIGHThis issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOEPSS 0.9%CVE-2026-55993HIGHApache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviourEPSS 0.9%CVE-2021-43792MEDIUMNotifications leak in DiscourseEPSS 0.9%CVE-2026-46726HIGHApache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headersEPSS 0.9%CVE-2024-6569MEDIUMCampaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path DisclosureEPSS 0.9%CVE-2019-25069MEDIUMAxios Italia Axios RE Error Message ASP.NET information disclosureEPSS 0.9%CVE-2021-27424MEDIUMGE UR family exposure of sensitive information to an unauthorized actorEPSS 0.9%