Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2024-35178HIGHJupyter server on Windows discloses Windows user password hashEPSS 0.8%CVE-2022-39029MEDIUMSmart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1EPSS 0.8%CVE-2022-0708MEDIUMTeam Creator's Email Address is disclosed to Team Members via one of the APIsEPSS 0.8%CVE-2025-45620HIGHAn issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted requestEPSS 0.8%CVE-2023-1681MEDIUMXunrui CMS test.php information disclosureEPSS 0.8%CVE-2024-29023HIGHSession Hijacking via token exposure on the session page in Xibo CMSEPSS 0.8%CVE-2024-2106MEDIUMMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST routeEPSS 0.8%CVE-2022-24398—Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to accessEPSS 0.8%CVE-2022-23643MEDIUMSide-channel attack in Sourcegraph Code MonitorsEPSS 0.8%CVE-2026-8385MEDIUMWP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX FallbackEPSS 0.8%CVE-2022-26423HIGHMISSING AUTHORIZATION CWE-862EPSS 0.8%CVE-2022-34313MEDIUMIBM CICS TX Standard is vulnerable to allowing attackers access to an application via insecure session cookiesEPSS 0.8%CVE-2023-40058MEDIUMSensitive Information Disclosure Vulnerability EPSS 0.8%CVE-2026-104203HIGHTraccar: Authentication bypass via path parameters exposes protected device mediaEPSS 0.8%CVE-2022-20811MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesEPSS 0.8%CVE-2026-78386HIGHUnauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook APIEPSS 0.8%CVE-2026-1194MEDIUMMineAdmin Swagger information disclosureEPSS 0.8%CVE-2021-22740—Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be expoEPSS 0.8%CVE-2023-48225HIGHLaf env causes sensitive information disclosureEPSS 0.8%CVE-2023-6777MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of ServiceEPSS 0.8%