Weaknesses of type CWE-312

502 results

Divulgação de informações sensíveis

A aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais) através de mecanismos que não deveria — logs, mensagens de erro, respostas HTTP, cache ou armazenamento inseguro. O risco é que um atacante, desenvolvedor ou qualquer pessoa com acesso ao sistema consegue extrair informações que comprometerem segurança ou privacidade.

Example

Uma API retorna mensagem de erro com detalhes da query SQL executada, ou logs de produção armazenam senhas em texto plano, ou resposta HTTP carrega um token JWT sem flag HttpOnly — em todos os casos, dados que deveriam ser secretos ficam acessíveis a quem não deveria.

How to mitigate

Sanitize mensagens de erro (retorne genéricas ao cliente, detalhe apenas em logs privados); nunca registre senhas, tokens ou PII em logs; use flags seguras em cookies (HttpOnly, Secure, SameSite); implemente controle de acesso a logs e artifacts; criptografe dados em repouso e em trânsito; revise regularmente o que está sendo exposto em respostas HTTP e exceções.

CVE-2026-59657HIGHApache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJobEPSS 0.3%CVE-2023-27370MEDIUMNETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-33026CRITICALnginx-ui Backup Restore Allows Tampering with Encrypted BackupsEPSS 0.3%CVE-2024-43429MEDIUMMoodle: user information visibility control issues in gradebook reportsEPSS 0.3%CVE-2023-25596MEDIUMAuthenticated Sensitive Information Disclosure in ClearPass Policy ManagerEPSS 0.3%CVE-2023-30527MEDIUMJenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins contrEPSS 0.3%CVE-2023-30530MEDIUMJenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on thEPSS 0.3%CVE-2022-21818MEDIUMNVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after siEPSS 0.3%CVE-2023-28345MEDIUMAn issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console pasEPSS 0.3%CVE-2025-59792MEDIUMApache Kvrocks: MONITOR command reveals plaintext credentials to non-adminsEPSS 0.3%CVE-2026-27877MEDIUMPublic dashboards discloses all direct mode datasourcesEPSS 0.3%CVE-2025-53672MEDIUMJenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controllEPSS 0.3%CVE-2024-51175HIGHAn issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component.EPSS 0.3%CVE-2025-59409HIGHFlock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartexEPSS 0.3%CVE-2024-11159MEDIUMUsing remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3EPSS 0.3%CVE-2024-40582HIGHPentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information.EPSS 0.3%CVE-2025-4537LOWyangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookieEPSS 0.3%CVE-2023-2335MEDIUMPlaintext Password in RegistryEPSS 0.3%CVE-2023-27243HIGHAn access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web requestEPSS 0.3%CVE-2026-20312HIGHCisco Catalyst SD-WAN Security Hardening Release - Information Disclosure VulnerabilitiesEPSS 0.3%