Weaknesses of type CWE-312

502 results

Divulgação de informações sensíveis

A aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais) através de mecanismos que não deveria — logs, mensagens de erro, respostas HTTP, cache ou armazenamento inseguro. O risco é que um atacante, desenvolvedor ou qualquer pessoa com acesso ao sistema consegue extrair informações que comprometerem segurança ou privacidade.

Example

Uma API retorna mensagem de erro com detalhes da query SQL executada, ou logs de produção armazenam senhas em texto plano, ou resposta HTTP carrega um token JWT sem flag HttpOnly — em todos os casos, dados que deveriam ser secretos ficam acessíveis a quem não deveria.

How to mitigate

Sanitize mensagens de erro (retorne genéricas ao cliente, detalhe apenas em logs privados); nunca registre senhas, tokens ou PII em logs; use flags seguras em cookies (HttpOnly, Secure, SameSite); implemente controle de acesso a logs e artifacts; criptografe dados em repouso e em trânsito; revise regularmente o que está sendo exposto em respostas HTTP e exceções.

CVE-2021-22929—An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps oEPSS 0.6%CVE-2024-4540HIGHKeycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookieEPSS 0.6%CVE-2023-24586LOWCleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authentEPSS 0.5%CVE-2023-5384HIGHInfinispan: credentials returned from configuration as clear textEPSS 0.5%CVE-2021-20995MEDIUMWAGO: Managed Switches: Storage of user credentials in a cookieEPSS 0.5%CVE-2022-3540MEDIUMAn issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticaEPSS 0.5%CVE-2022-24188HIGHThe /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the pictuEPSS 0.5%CVE-2022-41933MEDIUMPlaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-defaultEPSS 0.5%CVE-2025-34206CRITICALVasion Print (formerly PrinterLogic) Insecure Shared Storage PermissionsEPSS 0.5%CVE-2024-31486MEDIUMA vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without suEPSS 0.5%CVE-2022-2805MEDIUMA flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allowsEPSS 0.5%CVE-2021-35036MEDIUMA cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated atEPSS 0.5%CVE-2024-24375HIGHSQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.EPSS 0.5%CVE-2022-34339MEDIUM"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-FEPSS 0.5%CVE-2023-23944LOWNexcloud Mail app temporarily stores cleartext password in databaseEPSS 0.5%CVE-2024-36497CRITICALUnhashed Storage of PasswordEPSS 0.5%CVE-2022-48073HIGHPhicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.EPSS 0.5%CVE-2021-29481MEDIUMClient side sessions should not allow unencrypted storageEPSS 0.5%CVE-2023-22584HIGHCleartext credentials in Danfoss AK-EM100EPSS 0.5%CVE-2022-2813MEDIUMSourceCodester Guest Management System cleartext storageEPSS 0.5%