Weaknesses of type CWE-209

482 results

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação retorna mensagens de erro que revelam detalhes internos do sistema — como caminhos de arquivo, nomes de banco de dados, versões de software ou stack traces — para usuários não autorizados. Um atacante usa essas informações para mapear a infraestrutura e planejar exploits direcionados.

Example

Um formulário de login mostra 'Erro SQL: usuário não encontrado em tabela users_prod' ao invés de 'Credenciais inválidas'. O atacante descobre o nome exato da tabela e começa testes de SQL injection. Ou um erro de exceção expõe '/var/www/html/config.php:42', revelando a estrutura do servidor.

How to mitigate

Exiba mensagens de erro genéricas ao usuário final ('Operação não permitida'), e registre os detalhes técnicos apenas em logs internos do servidor. Desabilite stack traces e debug info em produção, use tratamento centralizado de exceções e valide/sanitize todo output antes de devolvê-lo ao cliente.

CVE-2025-4166MEDIUMVault May Include Sensitive Data in Error Logs When Using the KV v2 PluginEPSS 0.5%CVE-2026-11873MEDIUMPki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosureEPSS 0.5%CVE-2026-92936MEDIUMvm2 3.11.0 before 3.11.7 Information Disclosure via Error StackEPSS 0.5%CVE-2023-26272MEDIUMIBM Security Guardium Data Encryption information disclosureEPSS 0.5%CVE-2025-59872MEDIUMHCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,EPSS 0.5%CVE-2025-52022MEDIUMA vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed EPSS 0.5%CVE-2025-52023MEDIUMA vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed erroEPSS 0.5%CVE-2023-42475MEDIUMInformation Disclosure Vulnerability in Statutory ReportingEPSS 0.5%CVE-2026-53458MEDIUMBlueprint Studio API exposed internal exception detailsEPSS 0.5%CVE-2023-5514MEDIUM The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumeEPSS 0.4%CVE-2022-4870MEDIUMIn affected versions of Octopus Deploy it is possible to discover network details via error messageEPSS 0.4%CVE-2024-35119MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.4%CVE-2026-66009MEDIUMParse Server 9.0.0 Information Disclosure via GraphQL Error MessagesEPSS 0.4%CVE-2026-74879HIGHopenssl_encrypt before 1.4.0 Information Disclosure via /ready endpointEPSS 0.4%CVE-2024-8571MEDIUMerjemin roll_cms views.py information exposureEPSS 0.4%CVE-2024-39458LOWWhen Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnosticEPSS 0.4%CVE-2026-9794MEDIUMKeycloak: keycloak: information disclosure via saml ecp endpointEPSS 0.4%CVE-2023-0833MEDIUMRed hat a-mq streams: component version with information disclosure flawEPSS 0.4%CVE-2022-4769MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information EPSS 0.4%CVE-2022-4770MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information EPSS 0.4%