Weaknesses of type CWE-538

106 results

Exposição de informações sensíveis em arquivos acessíveis externamente

A aplicação escreve dados sensíveis (credenciais, tokens, chaves) em arquivos ou diretórios que podem ser acessados por usuários não autorizados. Isso pode ocorrer em logs, caches, arquivos temporários ou diretórios web públicos, expondo informações críticas.

Example

Uma aplicação gera um relatório em PDF com dados de clientes e o salva na pasta /var/www/html (acessível pela web), ou registra tokens de autenticação em um arquivo de log legível por qualquer usuário do sistema.

How to mitigate

Restrinja permissões de arquivo (chmod 600 ou equivalente), nunca escreva dados sensíveis em diretórios públicos, use variáveis de ambiente ou gestores de secrets para credenciais, e implemente rotação/limpeza automática de logs que contenham informações confidenciais.

CVE-2025-22633MEDIUMWordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-24689MEDIUMWordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-31421MEDIUMWordPress Srbtranslatin plugin <= 3.2.0 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-58458MEDIUMIn Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the EPSS 0.3%CVE-2025-61138HIGHQlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.EPSS 0.3%CVE-2023-54346HIGHWordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup DownloadEPSS 0.3%CVE-2026-6160MEDIUMcode-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosureEPSS 0.3%CVE-2025-36372MEDIUMIBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tablesEPSS 0.3%CVE-2022-4318HIGHCri-o: /etc/passwd tampering privescEPSS 0.3%CVE-2022-20864MEDIUMCisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-114195MEDIUMWordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-8452MEDIUMUnauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.EPSS 0.3%CVE-2018-4847—A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive informaEPSS 0.3%CVE-2022-43933MEDIUMconfiguration secrets are logged in support-saveEPSS 0.3%CVE-2025-68429HIGHStorybook manager bundle may expose environment variables during buildEPSS 0.3%CVE-2026-50565MEDIUMFission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder containerEPSS 0.3%CVE-2026-33705MEDIUMChamilo LMS has unauthenticated access to Twig template source files exposes application logicEPSS 0.2%CVE-2026-56065HIGHWordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-21672HIGHA vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.EPSS 0.2%CVE-2022-0013MEDIUMCortex XDR Agent: File Information Exposure Vulnerability When Generating Support FileEPSS 0.2%