Weaknesses of type CWE-359

214 results

Violação de Privacidade

É a exposição não autorizada de dados sensíveis de um usuário ou sistema, seja por falta de controle de acesso, logging inadequado, ou vazamento em logs/caches. O risco está em dados pessoais, credenciais ou informações confidenciais ficarem acessíveis quando não deveriam.

Example

Uma API que retorna o número de CPF de outros usuários na resposta de um endpoint de perfil público, ou um servidor que grava senhas em claro nos logs de aplicação, permitindo que administradores vejam credenciais de terceiros.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), nunca registre dados sensíveis em logs, aplique mascaramento de dados em APIs (ex: retornar apenas últimos 4 dígitos), e revise regularmente quem tem acesso a quê. Use ferramentas de DLP (Data Loss Prevention) para detectar vazamentos.

CVE-2025-43469MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS TahoEPSS 0.2%CVE-2025-66605LOWA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage withEPSS 0.2%CVE-2025-36131MEDIUMIBM Db2 information disclosureEPSS 0.2%CVE-2023-44213LOWSensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber ProteEPSS 0.2%CVE-2023-48680LOWSensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber ProteEPSS 0.2%CVE-2026-24078MEDIUMExposure of Private Personal Information to an Unauthorized Actor in Data ModemEPSS 0.2%CVE-2025-11598LOWExposure of Confidential Information in mObywatel applicationEPSS 0.2%CVE-2025-52602MEDIUMHCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query applicationEPSS 0.2%CVE-2026-21827LOWHCL Connections is vulnerable to an information disclosure vulnerabilityEPSS 0.2%CVE-2025-35981MEDIUMExposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to vieEPSS 0.1%CVE-2025-6017MEDIUMRhacm: users with clusterreader role can see credentials from managed-clustersEPSS 0.1%CVE-2025-5009LOWInformation Disclosure in Gemini iOS AppEPSS 0.1%CVE-2025-30459MEDIUMA privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensiEPSS 0.1%CVE-2025-10859MEDIUMData stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabsEPSS 0.1%