Weaknesses of type CWE-312

502 results

Divulgação de informações sensíveis

A aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais) através de mecanismos que não deveria — logs, mensagens de erro, respostas HTTP, cache ou armazenamento inseguro. O risco é que um atacante, desenvolvedor ou qualquer pessoa com acesso ao sistema consegue extrair informações que comprometerem segurança ou privacidade.

Example

Uma API retorna mensagem de erro com detalhes da query SQL executada, ou logs de produção armazenam senhas em texto plano, ou resposta HTTP carrega um token JWT sem flag HttpOnly — em todos os casos, dados que deveriam ser secretos ficam acessíveis a quem não deveria.

How to mitigate

Sanitize mensagens de erro (retorne genéricas ao cliente, detalhe apenas em logs privados); nunca registre senhas, tokens ou PII em logs; use flags seguras em cookies (HttpOnly, Secure, SameSite); implemente controle de acesso a logs e artifacts; criptografe dados em repouso e em trânsito; revise regularmente o que está sendo exposto em respostas HTTP e exceções.

CVE-2026-90842MEDIUMPHPGurukul Blood Donor Management System Login_Model.php cleartext storage in fileEPSS 0.3%CVE-2024-7259MEDIUMOvirt-engine: potential exposure of cleartext provider passwords via web uiEPSS 0.3%CVE-2024-46505CRITICALInfoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.EPSS 0.3%CVE-2025-25758HIGHAn issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdEPSS 0.3%CVE-2026-63406MEDIUMAnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including SecretsEPSS 0.3%CVE-2026-47702CRITICALTypeBot API tokens stored in plaintextEPSS 0.3%CVE-2026-25751CRITICALFUXA Unauthenticated Exposure of Plaintext Database CredentialsEPSS 0.3%CVE-2023-41964MEDIUMBIG-IP and BIG-IQ Database Variable vulnerabilityEPSS 0.3%CVE-2026-107807HIGHNginx UI: Node Secret Credential Exposure via URL Query ParameterEPSS 0.3%CVE-2026-31848HIGHReversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+EPSS 0.3%CVE-2025-65826CRITICALThe mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and foundEPSS 0.3%CVE-2024-34891MEDIUMInsufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange aEPSS 0.3%CVE-2026-15721CRITICALQuery Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.3%CVE-2025-62261MEDIUMLiferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92EPSS 0.3%CVE-2025-12772HIGHPlaintext Switch admin login password is seen in Brocade SANnav support saveEPSS 0.3%CVE-2019-14886MEDIUMA vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_securitEPSS 0.3%CVE-2022-22302MEDIUMA clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 andEPSS 0.3%CVE-2025-23027MEDIUMBASEHUB_TOKEN commited in next-forgeEPSS 0.3%CVE-2025-54538MEDIUMIn JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" commandEPSS 0.3%CVE-2025-54537MEDIUMIn JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshotsEPSS 0.3%