Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-32750MEDIUMDe-anonymization via messageEPSS 0.8%CVE-2021-31371MEDIUMJunos OS: QFX5000 Series: Traffic from the network internal to the device (128.0.0.0) may be forwarded to egress interfaces.EPSS 0.8%CVE-2022-28607HIGHAn issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive infEPSS 0.8%CVE-2023-5692MEDIUMWordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalinkEPSS 0.8%CVE-2024-39210HIGHBest House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php.EPSS 0.8%CVE-2026-42826CRITICALAzure DevOps Information Disclosure VulnerabilityEPSS 0.8%CVE-2024-47197HIGHMaven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentialsEPSS 0.8%CVE-2022-32229MEDIUMA information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs andEPSS 0.8%CVE-2022-32228MEDIUMAn information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does nEPSS 0.8%CVE-2026-54649LOWpunchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-ToEPSS 0.8%CVE-2023-39951MEDIUMInstrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backendEPSS 0.8%CVE-2024-41700HIGHBarix – CWE-200 Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.8%CVE-2026-23659HIGHAzure Data Factory Information Disclosure VulnerabilityEPSS 0.8%CVE-2020-12496MEDIUMENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actorEPSS 0.8%CVE-2021-31352MEDIUMSRC Series: NETCONF over SSH allows negotiation of weak ciphersEPSS 0.8%CVE-2020-10618—LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to sensitive information exposure by unauthorized users.EPSS 0.8%CVE-2025-14726MEDIUMWidgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpointsEPSS 0.8%CVE-2026-90881MEDIUMD-Link DIR-882 CGI Binary dllog.cgi main information disclosureEPSS 0.8%CVE-2024-4300CRITICALE-WEBInformationCo. FS-EZViewer(Web) - Sensitive Data ExposureEPSS 0.8%CVE-2023-44150HIGHWordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data ExposureEPSS 0.8%