Weaknesses of type CWE-200

5,714 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2021-37704MEDIUMExposed phpinfo() in PhpFastCacheEPSS 5.1%CVE-2022-32221CRITICALWhen doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when thEPSS 5.1%CVE-2022-28614—read beyond bounds via ap_rwrite()EPSS 5.1%CVE-2018-10915HIGHA vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between coEPSS 5.1%CVE-2022-29901MEDIUMArbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)EPSS 5.0%CVE-2017-5262—In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive informEPSS 4.9%CVE-2017-7899—An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWAEPSS 4.7%CVE-2022-27849MEDIUMWordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerabilityEPSS 4.6%CVE-2021-39211MEDIUMDisclosure of GLPI and server information in telemetry endpointEPSS 4.5%CVE-2021-22898LOWcurl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurEPSS 4.5%CVE-2025-59434CRITICALCritical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript FunctionEPSS 4.4%CVE-2021-28163LOWIn Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink,EPSS 4.2%CVE-2017-7575CRITICALSchneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\EPSS 4.1%CVE-2019-14893HIGHA flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserializatEPSS 4.1%CVE-2026-41266HIGHFlowise: Sensitive Data Leak in public-chatbotConfigEPSS 4.1%CVE-2023-47117HIGHObject Relational Mapper Leak Vulnerability in Filtering Task in Label StudioEPSS 4.1%CVE-2024-25734HIGHAn issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid usernamEPSS 4.1%CVE-2023-45131HIGHUnauthenticated access to new private chat messages in DiscourseEPSS 4.0%CVE-2022-29244HIGHnpm packing does not respect root-level ignore files in workspacesEPSS 4.0%CVE-2025-14528MEDIUMD-Link DIR-803 Configuration getcfg.php information disclosureEPSS 4.0%