Weaknesses of type CWE-294

213 results

Exposição de informação sensível a usuário não autorizado

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves API) para alguém que não deveria ter acesso. Isso ocorre por falha de controle de acesso, logging inadequado, erro em configuração ou vazamento em comunicação desprotegida. O risco é direto: credenciais ou dados privados caem em mãos erradas.

Example

Um endpoint de API retorna o hash de senha do usuário na resposta JSON, ou um arquivo de configuração com credenciais de banco de dados fica acessível publicamente no repositório git, ou um log de erro exibe o token de autenticação completo na tela do usuário final.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC/ABAC); nunca exponha segredos em respostas HTTP, logs ou versionamento; use variáveis de ambiente para credenciais; valide e sanitize erros antes de retornar ao cliente; revise regularmente permissões de arquivos e endpoints.

CVE-2023-50786MEDIUMDradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. TEPSS 0.2%CVE-2026-82470MEDIUMRodauth before 2.47.0 TOTP Code Reuse via Drift WindowEPSS 0.2%CVE-2026-94112HIGHmayswind ezBookkeeping before 2.0.0 TOTP Replay AttackEPSS 0.2%CVE-2026-15614HIGHIdP-initiated SAML sessions not reliably invalidated (replay)EPSS 0.2%CVE-2025-13777HIGHAuthentication Bypass due to Improper Session ValidationEPSS 0.2%CVE-2026-72780HIGHCraft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeyEPSS 0.2%CVE-2022-51016MEDIUMPocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login ReplayEPSS 0.2%CVE-2023-50128MEDIUMThe remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which EPSS 0.2%CVE-2026-46538MEDIUMMicrosoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injectionEPSS 0.2%CVE-2026-41000LOWWSS4J validation does not use configured replay cacheEPSS 0.2%CVE-2026-42602HIGHazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayEPSS 0.2%CVE-2025-6030CRITICALAutoeastern Smart Keyless Entry System Replay AttackEPSS 0.2%CVE-2024-5249MEDIUMSAML Replay in AkanaEPSS 0.2%CVE-2026-2540HIGHMicca KE700 Acceptance of previously used rolling codesEPSS 0.2%CVE-2024-3982HIGHAn attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product andEPSS 0.2%CVE-2024-38890HIGHAn issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attEPSS 0.2%CVE-2024-38272HIGHAuth Bypass in Quick ShareEPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2026-17268MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.2%CVE-2026-75034HIGHRancher: SAML Assertion ReplayEPSS 0.2%