Weaknesses of type CWE-200

5,715 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2024-7328MEDIUMYouDianCMS information disclosureEPSS 0.7%CVE-2021-25652MEDIUMAvaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure VulnerabilityEPSS 0.7%CVE-2021-20018—A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. TEPSS 0.7%CVE-2024-35230MEDIUMWelcome and About GeoServer pages communicate version and revision informationEPSS 0.7%CVE-2026-79853CRITICALUnauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10EPSS 0.7%CVE-2026-0789MEDIUMALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure VulnerabilityEPSS 0.7%CVE-2025-15082MEDIUMTOZED ZLT M30s Web Management proc_post information disclosureEPSS 0.7%CVE-2023-48294MEDIUMBroken Access control on Graphs Feature in LibreNMSEPSS 0.7%CVE-2026-20821MEDIUMRemote Procedure Call Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-54151HIGHDirectus allows unauthenticated access to WebSocket events and operationsEPSS 0.7%CVE-2021-37867MEDIUMEmails of all users are exposed via one of the Boards APIsEPSS 0.7%CVE-2023-6105MEDIUMManageEngine Information Disclosure in Multiple ProductsEPSS 0.7%CVE-2025-53066HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). EPSS 0.7%CVE-2022-44589HIGHWordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data ExposureEPSS 0.7%CVE-2022-35169—SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decryptEPSS 0.7%CVE-2026-25186MEDIUMWindows Accessibility Infrastructure (ATBroker.exe) Information Disclosure VulnerabilityEPSS 0.7%CVE-2025-8226MEDIUMyanyutao0402 ChanCMS find information disclosureEPSS 0.7%CVE-2018-3826—In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameEPSS 0.7%CVE-2018-8863MEDIUMPhilips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.7%CVE-2024-29898MEDIUMOversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikisEPSS 0.7%