Weaknesses of type CWE-201

501 results

Exposição de informações sensíveis em dados transmitidos

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais, chaves) em comunicações que não deveriam conter essas informações. O desenvolvedor inclui acidentalmente ou por falha de lógica dados confidenciais em respostas, logs, cookies ou requisições que podem ser interceptadas ou expostas.

Example

Um sistema de e-commerce retorna a senha do usuário em uma resposta JSON após login, ou inclui o token de autenticação em um parâmetro GET visível na URL, permitindo que seja capturada em logs de servidor ou histórico do navegador.

How to mitigate

Revise todo dado enviado em respostas HTTP, cookies e headers para eliminar informações sensíveis; use variáveis de ambiente para credenciais, nunca as codifique; aplique sanitização antes de escrever em logs; utilize HTTPS obrigatoriamente e tokens seguros com ciclo de vida limitado.

CVE-2025-9958HIGHInsertion of Sensitive Information Into Sent Data in GitLabEPSS 0.5%CVE-2025-67721MEDIUMAircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output bufferEPSS 0.5%CVE-2026-66901HIGHGoogle::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSONEPSS 0.5%CVE-2023-1401MEDIUMInsertion of Sensitive Information Into Sent Data in GitLabEPSS 0.5%CVE-2026-4035HIGHEnvironment Variable Resolution Vulnerability in mlflow/mlflowEPSS 0.5%CVE-2024-1435MEDIUMWordPress Tainacan plugin <= 0.20.6 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.5%CVE-2026-86497MEDIUMIn JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stEPSS 0.5%CVE-2025-31842MEDIUMWordPress Viral Loops WP Integration Plugin <= 3.4.0 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2026-64643MEDIUMNext.js: Unauthenticated Disclosure of Internal Server Function endpointsEPSS 0.5%CVE-2023-4378MEDIUMInsertion of Sensitive Information Into Sent Data in GitLabEPSS 0.5%CVE-2024-23506HIGHWordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2025-53196MEDIUMWordPress JetEngine <= 3.7.0 - Sensitive Data Exposure VulnerabilityEPSS 0.5%CVE-2024-7205CRITICALsharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary userEPSS 0.5%CVE-2024-13259HIGHImage Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023EPSS 0.5%CVE-2024-13254HIGHREST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018EPSS 0.5%CVE-2025-47775MEDIUMBullfrog's DNS over TCP bypasses domain filteringEPSS 0.5%CVE-2024-31278MEDIUMWordPress Premium Addons for Elementor plugin <= 4.10.22 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2025-49408CRITICALWordPress Templately Plugin <= 3.2.7 - Sensitive Data Exposure VulnerabilityEPSS 0.5%CVE-2025-24858HIGHDevelocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hasheEPSS 0.5%CVE-2026-5483HIGHOdh-dashboard: odh dashboard kubernetes service account exposureEPSS 0.5%