Weaknesses of type CWE-202

49 results

Exposição de informações sensíveis através de consultas de dados

A aplicação expõe dados confidenciais (senhas, tokens, PII) ao responder consultas que deveriam ser restritas ou filtradas. O problema ocorre quando o sistema não valida ou sanitiza adequadamente quais dados um usuário pode acessar, permitindo que requisições retornem informações que não deveriam estar visíveis.

Example

Uma API de busca de usuários retorna campos como senha hash ou token de reset mesmo quando o cliente não tem permissão para vê-los. Ou um endpoint de listagem de pedidos expõe dados de clientes de outras contas porque não há verificação de ownership na query.

How to mitigate

Implemente filtros de saída (output filtering) baseados em permissões: cada resultado deve passar por validação de acesso do usuário. Use princípio do menor privilégio nas queries, selecionando apenas colunas necessárias, e adicione testes automatizados que verificam se dados sensíveis vazam em respostas não autorizadas.

CVE-2024-20388MEDIUMA vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote atEPSS 0.5%CVE-2024-13255HIGHRESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019EPSS 0.5%CVE-2026-40245HIGHFree5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authenticationEPSS 0.5%CVE-2026-70473HIGHFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyEPSS 0.5%CVE-2026-42797MEDIUMApache Syncope: JexlContextBuilder Information DisclosureEPSS 0.4%CVE-2021-1372MEDIUMCisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-38897MEDIUMWAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.EPSS 0.4%CVE-2026-25050LOWVendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyEPSS 0.4%CVE-2025-29981HIGHDell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An EPSS 0.4%CVE-2024-38895MEDIUMWAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.EPSS 0.4%CVE-2024-38892MEDIUMAn issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.EPSS 0.4%CVE-2026-77883MEDIUMApache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylistEPSS 0.4%CVE-2026-40533MEDIUMAn exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69EPSS 0.4%CVE-2025-36575HIGHDell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An uEPSS 0.4%CVE-2024-2088HIGHNextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information ExposureEPSS 0.3%CVE-2025-64504MEDIUMLangfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIsEPSS 0.3%CVE-2026-79633HIGHApache Answer: Missing Authorization Allows Mutations of Non-Public ContentEPSS 0.3%CVE-2025-64528MEDIUMUsers are able to find users by name even when `enable_names` is offEPSS 0.3%CVE-2026-103440LOWpagetriagelist discloses suppressed reviewer usernamesEPSS 0.3%CVE-2026-79613MEDIUMApache Answer: Disclosure of Comments on Non-Public Content Through Public ProfilesEPSS 0.3%