Weaknesses of type CWE-209

482 results

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação retorna mensagens de erro que revelam detalhes internos do sistema — como caminhos de arquivo, nomes de banco de dados, versões de software ou stack traces — para usuários não autorizados. Um atacante usa essas informações para mapear a infraestrutura e planejar exploits direcionados.

Example

Um formulário de login mostra 'Erro SQL: usuário não encontrado em tabela users_prod' ao invés de 'Credenciais inválidas'. O atacante descobre o nome exato da tabela e começa testes de SQL injection. Ou um erro de exceção expõe '/var/www/html/config.php:42', revelando a estrutura do servidor.

How to mitigate

Exiba mensagens de erro genéricas ao usuário final ('Operação não permitida'), e registre os detalhes técnicos apenas em logs internos do servidor. Desabilite stack traces e debug info em produção, use tratamento centralizado de exceções e valide/sanitize todo output antes de devolvê-lo ao cliente.

CVE-2025-40653MEDIUMUser enumeration in M3M Printer Server WebEPSS 0.4%CVE-2026-73555MEDIUMvLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error MessagesEPSS 0.4%CVE-2026-22646MEDIUMCertain error messages returned by the application expose internal system details that should not be visible to end users, providing attackeEPSS 0.4%CVE-2026-105283MEDIUMInternal error terms inspected into AshTypescript RPC error responsesEPSS 0.4%CVE-2025-49128MEDIUMJackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationEPSS 0.4%CVE-2024-21866MEDIUMGeneration of Error Message Containing Sensitive Information in Rapid SCADAEPSS 0.4%CVE-2021-21416LOWPotential sensitive information disclosed in error reportsEPSS 0.4%CVE-2025-13596LOWImproper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6EPSS 0.4%CVE-2023-49107MEDIUMGeneration of Error Message Containing Sensitive Information Vulnerability in Hitachi Device ManagerEPSS 0.4%CVE-2024-36106MEDIUMArgo CD allows authenticated users to enumerate clusters by nameEPSS 0.4%CVE-2025-69253MEDIUMfree5GC vulnerable to improper error handling in NEF with information exposureEPSS 0.4%CVE-2026-8861MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2026-3626MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.4%CVE-2025-41441MEDIUMMailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attackerEPSS 0.4%CVE-2025-1350MEDIUMMultiple vulnerabilities in IBM ControllerEPSS 0.4%CVE-2026-11904MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2026-115496MEDIUMWorkflow names may be leaked to unauthenticated users in KNIME Business HubEPSS 0.4%CVE-2025-31998LOWHCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive informationEPSS 0.4%CVE-2024-52893MEDIUMIBM Concert Software information disclosureEPSS 0.4%CVE-2025-8852MEDIUMWuKongOpenSource WukongCRM API Response upload information exposureEPSS 0.4%