Fallos del tipo CWE-200

5714 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2021-39857MEDIUMAdobe Acrobat Reader DC Information Disclosure via ActiveX LoadFileEPSS 2.5%CVE-2022-1077MEDIUMTEM FLEX-1080/FLEX-1085 Log information disclosureEPSS 2.5%CVE-2022-22547—Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted EPSS 2.5%CVE-2025-12139HIGHFile Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information ExposureEPSS 2.5%CVE-2018-16876LOWansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leEPSS 2.5%CVE-2023-32561HIGHA previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authenticaEPSS 2.4%CVE-2019-7619—Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated aEPSS 2.4%CVE-2025-50738CRITICALThe Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo contEPSS 2.4%CVE-2024-1209MEDIUMLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignmentsEPSS 2.4%CVE-2021-41532—Unauthenticated access to Ozone Recon HTTP endpointsEPSS 2.4%CVE-2026-2262HIGHEasy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST APIEPSS 2.4%CVE-2024-42049CRITICALTightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.EPSS 2.4%CVE-2024-12008MEDIUMW3 Total Cache <= 2.8.1 Information Exposure via Log FilesEPSS 2.4%CVE-2021-39855MEDIUMAdobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via src ParameterEPSS 2.4%CVE-2021-39856MEDIUMAdobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via LoadFileEPSS 2.4%CVE-2014-2347—AMTELCO miSecure Information ExposureEPSS 2.3%CVE-2025-9209CRITICALRestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWTEPSS 2.3%CVE-2017-6626—A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise (UCCE) 11.5(1) and 11.6(1) could allowEPSS 2.3%CVE-2025-24204CRITICALThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.EPSS 2.3%CVE-2020-8216—An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting detailsEPSS 2.3%