Weaknesses of type CWE-209

482 results

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação retorna mensagens de erro que revelam detalhes internos do sistema — como caminhos de arquivo, nomes de banco de dados, versões de software ou stack traces — para usuários não autorizados. Um atacante usa essas informações para mapear a infraestrutura e planejar exploits direcionados.

Example

Um formulário de login mostra 'Erro SQL: usuário não encontrado em tabela users_prod' ao invés de 'Credenciais inválidas'. O atacante descobre o nome exato da tabela e começa testes de SQL injection. Ou um erro de exceção expõe '/var/www/html/config.php:42', revelando a estrutura do servidor.

How to mitigate

Exiba mensagens de erro genéricas ao usuário final ('Operação não permitida'), e registre os detalhes técnicos apenas em logs internos do servidor. Desabilite stack traces e debug info em produção, use tratamento centralizado de exceções e valide/sanitize todo output antes de devolvê-lo ao cliente.

CVE-2022-4770MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information EPSS 0.4%CVE-2026-116478MEDIUMa2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposureEPSS 0.4%CVE-2024-45658LOWIBM Security Verify Access information disclosureEPSS 0.4%CVE-2022-0563MEDIUMA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" envirEPSS 0.4%CVE-2023-23474LOWIBM Cognos Controller information disclosureEPSS 0.4%CVE-2026-73101CRITICALApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsEPSS 0.4%CVE-2024-52043MEDIUMUser enumeration in HubHubEPSS 0.4%CVE-2025-40718MEDIUMImproper error handling vulnerability in Quiter GatewayEPSS 0.4%CVE-2026-91882HIGHDell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible FilEPSS 0.4%CVE-2026-59943MEDIUMDompdf: Embedded SVG images can leak existence of files and directories within the filesystemEPSS 0.4%CVE-2021-27774LOWAn injection vulnerability affects HCL Digital ExperienceEPSS 0.4%CVE-2025-68110CRITICALChurchCRM discloses database information on error messageEPSS 0.4%CVE-2026-4633LOWKeycloak: keycloak: user enumeration via differential error messagesEPSS 0.4%CVE-2026-17114MEDIUMMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%CVE-2025-46658CRITICALAn issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.EPSS 0.4%CVE-2026-85709MEDIUMLightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesEPSS 0.4%CVE-2024-39751MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.4%CVE-2026-17098MEDIUMMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%CVE-2024-13540MEDIUMWooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path DsiclosureEPSS 0.4%CVE-2024-13539MEDIUMAForms Eats <= 1.3.1 - Unauthenticated Full Path DisclosureEPSS 0.4%