Fallos del tipo CWE-200

5714 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2019-5017MEDIUMAn exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functioEPSS 2.1%CVE-2018-14642MEDIUMAn information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that hanEPSS 2.1%CVE-2024-43609MEDIUMMicrosoft Office Spoofing VulnerabilityEPSS 2.1%CVE-2022-23634HIGHInformation Exposure when using Puma with RailsEPSS 2.1%CVE-2018-0278—A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensiEPSS 2.1%CVE-2024-8460MEDIUMD-Link DNS-320 Web Management Interface widget_api.cgi information disclosureEPSS 2.1%CVE-2022-29165CRITICALArgo CD will blindly trust JWT claims if anonymous access is enabledEPSS 2.1%CVE-2021-29450MEDIUMWordPress Authenticated disclosure of password-protected posts and pagesEPSS 2.1%CVE-2025-11693CRITICALExport WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log FileEPSS 2.1%CVE-2023-29348HIGHWindows Remote Desktop Gateway (RD Gateway) Information Disclosure VulnerabilityEPSS 2.1%CVE-2017-15087—It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEEPSS 2.1%CVE-2021-31173MEDIUMMicrosoft SharePoint Server Information Disclosure VulnerabilityEPSS 2.1%CVE-2021-30168CRITICALMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1EPSS 2.1%CVE-2021-34485MEDIUM.NET Core and Visual Studio Information Disclosure VulnerabilityEPSS 2.1%CVE-2023-36894MEDIUMMicrosoft SharePoint Server Information Disclosure VulnerabilityEPSS 2.1%CVE-2022-26869CRITICALDell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentialEPSS 2.1%CVE-2023-6266HIGHBackup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information ExposureEPSS 2.1%CVE-2025-22828MEDIUMApache CloudStack: Unauthorised access to annotationsEPSS 2.1%CVE-2018-10890MEDIUMA flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to reEPSS 2.1%CVE-2025-53624CRITICALdocusaurus-plugin-content-gists Exposes GitHub Personal Access TokenEPSS 2.0%