Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2026-94265CRITICALAuthorization: Negotiate sent to foreign originEPSS 0.8%CVE-2026-32151MEDIUMWindows Shell Information Disclosure VulnerabilityEPSS 0.8%CVE-2022-31069MEDIUMPotential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxyEPSS 0.8%CVE-2022-31070MEDIUMPotential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxyEPSS 0.8%CVE-2017-3892LOWIn BlackBerry QNX Software Development Platform (SDP) 6.6.0, an information disclosure vulnerability in the default configuration of the QNXEPSS 0.8%CVE-2025-3975MEDIUMScriptAndTools eCommerce-website-in-PHP subscriber-csv.php information disclosureEPSS 0.8%CVE-2023-43617—An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secretEPSS 0.8%CVE-2021-22825HIGHA CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the systemEPSS 0.8%CVE-2020-15794—A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to tEPSS 0.8%CVE-2023-40385MEDIUMThis issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. A remote EPSS 0.8%CVE-2022-36074MEDIUMAuthentication headers exposed on by Nextcloud ServerEPSS 0.8%CVE-2021-22047—In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllersEPSS 0.8%CVE-2024-1404MEDIUMLinksys WRT54GL Web Management Interface SysInfo.htm information disclosureEPSS 0.8%CVE-2024-27456CRITICALrack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.EPSS 0.8%CVE-2023-40735HIGHButterfly Button Project - Sensitive Information DisclosureEPSS 0.8%CVE-2021-4180—An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attackeEPSS 0.8%CVE-2023-0814MEDIUMProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via ShortcodeEPSS 0.8%CVE-2022-25990MEDIUMOn 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions whicEPSS 0.8%CVE-2023-25165MEDIUMgetHostByName Function Information DisclosureEPSS 0.8%CVE-2026-47751MEDIUMClaude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret ExfiltrationEPSS 0.8%