Weaknesses of type CWE-209

482 results

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação retorna mensagens de erro que revelam detalhes internos do sistema — como caminhos de arquivo, nomes de banco de dados, versões de software ou stack traces — para usuários não autorizados. Um atacante usa essas informações para mapear a infraestrutura e planejar exploits direcionados.

Example

Um formulário de login mostra 'Erro SQL: usuário não encontrado em tabela users_prod' ao invés de 'Credenciais inválidas'. O atacante descobre o nome exato da tabela e começa testes de SQL injection. Ou um erro de exceção expõe '/var/www/html/config.php:42', revelando a estrutura do servidor.

How to mitigate

Exiba mensagens de erro genéricas ao usuário final ('Operação não permitida'), e registre os detalhes técnicos apenas em logs internos do servidor. Desabilite stack traces e debug info em produção, use tratamento centralizado de exceções e valide/sanitize todo output antes de devolvê-lo ao cliente.

CVE-2025-52611LOWHCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerabilityEPSS 0.2%CVE-2026-123036MEDIUMA flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exceptEPSS 0.2%CVE-2024-56812LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56467LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56495LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56811LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56493LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56496LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56810LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56494LOWIBM EntireX information disclosureEPSS 0.1%CVE-2026-29110LOWCryptomator: Leaking of cleartext paths into log file in non-debug modeEPSS 0.1%CVE-2025-40760MEDIUMA vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messageEPSS 0.1%CVE-2026-21809LOWHCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive informationEPSS 0.1%CVE-2022-20525LOWIn enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissioEPSS 0.1%CVE-2026-88467MEDIUMCRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors EPSS 0.1%CVE-2026-27004MEDIUMOpenClaw session tool visibility hardening and Telegram webhook secret fallbackEPSS 0.1%CVE-2026-7860LOWPossible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend BuildEPSS 0.1%CVE-2025-52641LOWInternal Filesystem Exploration vulnerabilityEPSS 0.1%CVE-2026-85115MEDIUMA vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do nEPSS 0.1%CVE-2025-22421MEDIUMIn contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen dueEPSS 0.1%