Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2024-31455MEDIUMMinder GetRepositoryByName data leakEPSS 0.8%CVE-2022-31177LOWPossible to infer sensitive information through query strings in Flask-AppBuilderEPSS 0.8%CVE-2024-24758LOWProxy-Authorization header not cleared on cross-origin redirect in fetch in UndiciEPSS 0.8%CVE-2025-27675CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-EPSS 0.8%CVE-2023-23592HIGHWALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information.EPSS 0.8%CVE-2025-30224MEDIUMMyDumper arbitrary file read issueEPSS 0.8%CVE-2022-45103MEDIUM Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerabiEPSS 0.8%CVE-2021-24661—PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content DisclosureEPSS 0.8%CVE-2023-48671HIGH Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. A remote attacker could potentially exploit tEPSS 0.8%CVE-2021-41090MEDIUMInstance config inline secret exposureEPSS 0.8%CVE-2023-46315—The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable DiEPSS 0.8%CVE-2023-28444CRITICALangular-server-side-configuration information disclosure vulnerability in monorepo with node.js backendEPSS 0.8%CVE-2026-40151MEDIUMPraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOSEPSS 0.8%CVE-2022-29916MEDIUMFirefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been usEPSS 0.8%CVE-2024-34708MEDIUMDirectus allows redacted data extraction on the API through "alias"EPSS 0.8%CVE-2024-29384HIGHAn issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules functEPSS 0.8%CVE-2025-7565MEDIUMLB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosureEPSS 0.8%CVE-2024-33437HIGHAn issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS Style RulesEPSS 0.8%CVE-2026-47655MEDIUMMicrosoft Graph Information Disclosure VulnerabilityEPSS 0.8%CVE-2024-29961HIGHsupply-chain attack riskEPSS 0.8%