Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2023-33848MEDIUMIBM CICS TX information disclosureEPSS 0.8%CVE-2023-5166HIGHDocker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URLEPSS 0.8%CVE-2025-43189CRITICALThis issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may EPSS 0.8%CVE-2021-20993MEDIUMWAGO: Managed Switches: Exposure of sensitive information through directory listingEPSS 0.8%CVE-2023-22503MEDIUMAffected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labelEPSS 0.8%CVE-2023-24827MEDIUMCredential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syftEPSS 0.8%CVE-2024-4596LOWKimai Session information disclosureEPSS 0.8%CVE-2018-1059—The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing EPSS 0.8%CVE-2023-6100MEDIUMMaiwei Safety Production Control Platform GetItemList information disclosureEPSS 0.8%CVE-2022-22277—A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext.EPSS 0.8%CVE-2021-21440MEDIUMSupport Bundle includes S/Mime and PGP keysEPSS 0.8%CVE-2022-22276—A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user.EPSS 0.8%CVE-2023-1710MEDIUMA sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 EPSS 0.8%CVE-2024-23331HIGHVite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystemEPSS 0.8%CVE-2024-36307MEDIUMA security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose senEPSS 0.8%CVE-2023-1680MEDIUMXunrui CMS main.html information disclosureEPSS 0.8%CVE-2024-7704MEDIUMWeaver e-cology Source Code ecology_dev.zip information disclosureEPSS 0.8%CVE-2019-11294MEDIUMCAPI leaks service broker URLs and GUIDs to space developersEPSS 0.8%CVE-2026-24098MEDIUMApache Airflow: Assigning single DAG permission leaked all DAGs Import ErrorsEPSS 0.8%CVE-2017-3892LOWIn BlackBerry QNX Software Development Platform (SDP) 6.6.0, an information disclosure vulnerability in the default configuration of the QNXEPSS 0.8%