Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2023-26108LOWVersions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerEPSS 0.7%CVE-2023-42940MEDIUMA session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their EPSS 0.7%CVE-2020-5414MEDIUMApp Autoscaler logs credentialsEPSS 0.7%CVE-2021-3590—A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the AEPSS 0.7%CVE-2025-21214MEDIUMWindows BitLocker Information Disclosure VulnerabilityEPSS 0.7%CVE-2022-23726MEDIUMPingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amoEPSS 0.7%CVE-2023-0658MEDIUMMultilaser RE057/RE170 Backup File param.file.tgz information disclosureEPSS 0.7%CVE-2019-3811MEDIUMA vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead oEPSS 0.7%CVE-2026-22016HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). EPSS 0.7%CVE-2026-21515CRITICALAzure IoT Central Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-61802MEDIUMWazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/configEPSS 0.7%CVE-2024-23662MEDIUMAn exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 thEPSS 0.7%CVE-2024-22022HIGHVulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash EPSS 0.7%CVE-2024-23962MEDIUMAlpine Halo9 Missing AuthenticationEPSS 0.7%CVE-2023-23620MEDIUMDiscourse restricted tag routes leak topic informationEPSS 0.7%CVE-2021-25652MEDIUMAvaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-34080MEDIUMMantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.7%CVE-2021-23193HIGHImproper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators EPSS 0.7%CVE-2022-39212MEDIUMLast video frame is still sent after video is disabled in a call in Nextcloud TalkEPSS 0.7%CVE-2021-23204HIGHExposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be eEPSS 0.7%