Weaknesses of type CWE-212

88 results

Divulgação de Informações

Fraqueza genérica onde a aplicação expõe dados sensíveis (credenciais, tokens, chaves, dados pessoais) a usuários não autorizados ou em contextos onde não deveria. O risco é que informações confidenciais se tornem acessíveis, comprometendo confidencialidade e facilitando ataques subsequentes.

Example

Uma API retorna mensagens de erro com stack traces completos contendo caminhos de arquivo e nomes de variáveis internas; ou um arquivo de configuração é deixado publicamente acessível e expõe credenciais de banco de dados; ou cookies de sessão são transmitidos sem HTTPS.

How to mitigate

Implemente controle de acesso rigoroso e valide permissões antes de expor dados. Trate erros de forma genérica para o usuário final, registre detalhes apenas em logs do servidor. Use HTTPS, marque cookies com flags `HttpOnly` e `Secure`, e revise regularmente o que está sendo exposto via APIs, logs e páginas de erro.

CVE-2026-46657HIGHBludit's persistent authentication tokens not revoked upon account disablementEPSS 0.3%CVE-2026-43824HIGHIn Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.EPSS 0.3%CVE-2026-73440LOWSecurity Advisory 0178EPSS 0.3%CVE-2021-33082MEDIUMSensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow EPSS 0.3%CVE-2026-111387HIGHNezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List EndpointEPSS 0.3%CVE-2021-33080MEDIUMExposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD anEPSS 0.3%CVE-2026-96879MEDIUM"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"EPSS 0.3%CVE-2026-42186LOWOpenBao's Namespace Deletion May Not Delete Data ProperlyEPSS 0.2%CVE-2026-27892MEDIUMFacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/DownloadEPSS 0.2%CVE-2025-65000LOWExposure of SSH Private Keys in Remote Alert Handlers (Linux) RuleEPSS 0.2%CVE-2026-1182MEDIUMImproper Removal of Sensitive Information Before Storage or Transfer in GitLabEPSS 0.2%CVE-2026-34214HIGHTrino: Iceberg REST catalog static and vended credentials are accessible via query JSONEPSS 0.2%CVE-2025-64326LOWWeblate leaks the IP of project members inviting users to assume reviewer roles in Audit logEPSS 0.2%CVE-2025-24884MEDIUMkube-audit-rest's example logging configuration could disclose secret values in the audit logEPSS 0.2%CVE-2025-0011LOWImproper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address EPSS 0.2%CVE-2026-53604HIGHnebula-mesh: CA private key not zeroized on web mobile-bundle error pathsEPSS 0.2%CVE-2026-32891CRITICALAnchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSSEPSS 0.2%CVE-2025-8860LOWQemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callbackEPSS 0.2%CVE-2025-65965HIGHGrype has a credential disclosure vulnerability in Grype JSON outputEPSS 0.2%CVE-2026-118996MEDIUMCallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfigEPSS 0.2%