Fallos del tipo CWE-200

4959 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2026-34090MEDIUMSuggested investigations: Handle suppressed usernamesEPSS 0.4%CVE-2024-6556MEDIUMSmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path DisclosureEPSS 0.4%CVE-2024-8756MEDIUMQuform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information ExposureEPSS 0.4%CVE-2025-2842MEDIUMTempo-operator: tempo operator token exposition lead to read sensitive dataEPSS 0.4%CVE-2023-23499—This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS EPSS 0.4%CVE-2025-12010MEDIUMAuthors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's ShortcodeEPSS 0.4%CVE-2025-49150MEDIUMCursor Agent Potentially Leaks Information using JSON schemaEPSS 0.4%CVE-2026-54304HIGHn8n: SecurityScorecard Node Leaks API Token to User-Controlled HostEPSS 0.4%CVE-2026-5266LOWExposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated wiEPSS 0.4%CVE-2026-72760MEDIUMcti-transmute Following List Exposes User Email Addresses to Authenticated UsersEPSS 0.4%CVE-2025-13596LOWImproper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6EPSS 0.4%CVE-2025-53003HIGHJanssen Config API returns results without scope verificationEPSS 0.4%CVE-2026-94050MEDIUMD-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosureEPSS 0.4%CVE-2026-54396MEDIUMMISP AuthKey edit endpoint allows authenticated user email enumerationEPSS 0.4%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.4%CVE-2026-28920MEDIUMAn information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26EPSS 0.4%CVE-2024-21040MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.4%CVE-2023-37232HIGHLoftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor.EPSS 0.4%CVE-2018-16883LOWsssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parEPSS 0.4%CVE-2025-23174HIGHYoel Geva - CWE-200: Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.4%