Weaknesses of type CWE-312

469 results

Divulgação de informações sensíveis

A aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais) através de mecanismos que não deveria — logs, mensagens de erro, respostas HTTP, cache ou armazenamento inseguro. O risco é que um atacante, desenvolvedor ou qualquer pessoa com acesso ao sistema consegue extrair informações que comprometerem segurança ou privacidade.

Example

Uma API retorna mensagem de erro com detalhes da query SQL executada, ou logs de produção armazenam senhas em texto plano, ou resposta HTTP carrega um token JWT sem flag HttpOnly — em todos os casos, dados que deveriam ser secretos ficam acessíveis a quem não deveria.

How to mitigate

Sanitize mensagens de erro (retorne genéricas ao cliente, detalhe apenas em logs privados); nunca registre senhas, tokens ou PII em logs; use flags seguras em cookies (HttpOnly, Secure, SameSite); implemente controle de acesso a logs e artifacts; criptografe dados em repouso e em trânsito; revise regularmente o que está sendo exposto em respostas HTTP e exceções.

CVE-2026-76381MEDIUMInformation Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAREPSS 0.1%CVE-2026-76380MEDIUMInformation Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAREPSS 0.1%CVE-2026-76376MEDIUMInformation Disclosure through Action Parameters in AWS IAM app for Splunk SOAREPSS 0.1%CVE-2026-76405MEDIUMInformation Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) appEPSS 0.1%CVE-2026-76386MEDIUMInformation Disclosure through Action Parameters in Zoom app for Splunk SOAREPSS 0.1%CVE-2024-53979HIGHAnsible collection "ibm.ibm_zhmc" has passwords in clear text in log file and in output of some modules when specified as inputEPSS 0.1%CVE-2026-76384MEDIUMInformation Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAREPSS 0.1%CVE-2025-53670MEDIUMJenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml fiEPSS 0.1%CVE-2022-2569MEDIUMARC Informatique PcVueEPSS 0.1%CVE-2024-36119LOWPassword confirmation stored in plain text via registration form in statamic/cmsEPSS 0.1%CVE-2022-42931LOWLogins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk. Instead, the usernaEPSS 0.1%CVE-2023-26593HIGHCENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who canEPSS 0.1%CVE-2024-53865HIGHPython package "zhmcclient" has passwords in clear text in its HMC and API logsEPSS 0.1%CVE-2026-44940MEDIUMService token exposure and potential privilege escalation in SUSE ObservabilityEPSS 0.1%CVE-2025-3442MEDIUMInformation Disclosure Vulnerability in TP-Link Tapo IoT Smart HubEPSS 0.1%CVE-2026-4387LOWUnencrypted storage of authentication state in StrongDM Desktop Application state.kv fileEPSS 0.1%CVE-2025-55280MEDIUMInformation Disclosure Vulnerability in ZKTeco WL20EPSS 0.1%CVE-2025-2922LOWNetis WF-2404 BusyBox Shell cleartext storageEPSS 0.1%CVE-2022-31697MEDIUMThe vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with aEPSS 0.1%CVE-2023-24964MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.1%