Weaknesses of type CWE-201

501 results

Exposição de informações sensíveis em dados transmitidos

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais, chaves) em comunicações que não deveriam conter essas informações. O desenvolvedor inclui acidentalmente ou por falha de lógica dados confidenciais em respostas, logs, cookies ou requisições que podem ser interceptadas ou expostas.

Example

Um sistema de e-commerce retorna a senha do usuário em uma resposta JSON após login, ou inclui o token de autenticação em um parâmetro GET visível na URL, permitindo que seja capturada em logs de servidor ou histórico do navegador.

How to mitigate

Revise todo dado enviado em respostas HTTP, cookies e headers para eliminar informações sensíveis; use variáveis de ambiente para credenciais, nunca as codifique; aplique sanitização antes de escrever em logs; utilize HTTPS obrigatoriamente e tokens seguros com ciclo de vida limitado.

CVE-2026-63481MEDIUMHurl: Cookies in Cookies section leak when redirecting to a different hostEPSS 0.7%CVE-2026-8924CRITICALtrailing dot domain super cookieEPSS 0.7%CVE-2026-55553HIGHurllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakageEPSS 0.7%CVE-2026-100258MEDIUMIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settingsEPSS 0.7%CVE-2025-66566HIGHyawkat LZ4 Java has a possible information leak in Java safe decompressorEPSS 0.6%CVE-2023-28117HIGHSentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`EPSS 0.6%CVE-2026-42880CRITICALArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionEPSS 0.6%CVE-2024-50633NONEA Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted PEPSS 0.6%CVE-2025-48045HIGHMICI Network Co. Ltd. NetFax Server Default Administrator Credentials DisclosureEPSS 0.6%CVE-2026-32829HIGHlz4_flex: Decompression can leak information from uninitialized memory or reused output bufferEPSS 0.6%CVE-2022-23488MEDIUMBigBlueButton vulnerable to Insertion of Sensitive Information Into Sent DataEPSS 0.6%CVE-2022-28224MEDIUMCalico and Calico Enterprise may be vulnerable to route hijacking with the floating IP featureEPSS 0.6%CVE-2025-23781HIGHWordPress WM Options Import Export plugin <= 1.0.1 - Sensitive Data Exposure vulnerabilityEPSS 0.6%CVE-2026-6267HIGHInsertion of Sensitive Information Into Sent Data in GitLabEPSS 0.6%CVE-2026-39912CRITICALv2board / Xboard Authentication Token Exposure via loginWithMailLinkEPSS 0.6%CVE-2023-3299LOWNomad Caller ACL Token's Secret ID is Exposed to SentinelEPSS 0.6%CVE-2025-59509MEDIUMWindows Speech Recognition Information Disclosure VulnerabilityEPSS 0.6%CVE-2023-3949MEDIUMInsertion of Sensitive Information Into Sent Data in GitLabEPSS 0.6%CVE-2023-4002MEDIUMInsertion of Sensitive Information Into Sent Data in GitLabEPSS 0.6%CVE-2023-1975HIGHInsertion of Sensitive Information Into Sent Data in answerdev/answerEPSS 0.6%