Weaknesses of type CWE-200

4,927 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2022-39166MEDIUMIBM Security Guardium information disclosureEPSS 0.6%CVE-2026-20027MEDIUMCisco Snort DCERPC Stub Data Out of Bounds ReadEPSS 0.6%CVE-2022-24670HIGHAny user can run unrestricted LDAP queries against a configuration endpointEPSS 0.6%CVE-2024-35189MEDIUMSensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in FidesEPSS 0.6%CVE-2024-24309HIGHIn the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information witEPSS 0.6%CVE-2024-3682MEDIUMWP STAGING <= 3.4.3 and WP STAGING Pro <= 5.4.3 - Sensitive Information Exposure via Log FileEPSS 0.6%CVE-2021-39190MEDIUMSCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.6%CVE-2023-22453MEDIUMDiscourse vulnerable to exposure of user post counts per topic to unauthorized usersEPSS 0.6%CVE-2024-34549MEDIUMWordPress WP Job Manager plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityEPSS 0.6%CVE-2021-25426—Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applicEPSS 0.6%CVE-2024-35165MEDIUMWordPress Gutenify plugin <= 1.4.0 - Sensitive Data Exposure via API vulnerabilityEPSS 0.6%CVE-2023-25499MEDIUMPossible information disclosure in non visible componentsEPSS 0.6%CVE-2024-25458HIGHAn issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM_48B_BC01_v87_0903 allows a remote EPSS 0.6%CVE-2024-6210MEDIUMDuplicator <= 1.5.9 - Full Path DisclosureEPSS 0.6%CVE-2024-0765CRITICALDefault user role exporting save state of instanceEPSS 0.6%CVE-2024-24313HIGHAn issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php andEPSS 0.6%CVE-2019-18177MEDIUMIn certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint.EPSS 0.6%CVE-2012-10016MEDIUMHalulu simple-download-button-shortcode Plugin Download simple-download-button_dl.php information disclosureEPSS 0.6%CVE-2022-41618LOWWordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerabilityEPSS 0.6%CVE-2023-36817HIGHThe King's Temple Church website Leaked Stripe API Key in Public Code RepositoryEPSS 0.6%