Fallos del tipo CWE-200

5714 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2020-15099HIGHExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSEPSS 1.8%CVE-2024-21136HIGHVulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are aEPSS 1.8%CVE-2020-11021MEDIUMHTTP request which redirect to another hostname do not strip authorization header in Actions Http-ClientEPSS 1.8%CVE-2019-10223MEDIUMA security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 releasEPSS 1.8%CVE-2022-0235MEDIUMExposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetchEPSS 1.8%CVE-2016-7061LOWAn information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuEPSS 1.8%CVE-2022-34692MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 1.8%CVE-2019-10156MEDIUMA flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of EPSS 1.8%CVE-2025-1636MEDIUMExposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and EPSS 1.8%CVE-2025-1635MEDIUMExposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows aEPSS 1.8%CVE-2016-6542—The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the deviceEPSS 1.7%CVE-2021-20313—A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is poEPSS 1.7%CVE-2021-27434—Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework verEPSS 1.7%CVE-2018-0105—A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitiEPSS 1.7%CVE-2024-21380HIGHMicrosoft Dynamics Business Central/NAV Information Disclosure VulnerabilityEPSS 1.7%CVE-2017-6614—A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authentiEPSS 1.7%CVE-2018-14803—Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vulnerability that couldEPSS 1.7%CVE-2018-1097—A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discovEPSS 1.7%CVE-2020-8232—An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized EPSS 1.7%CVE-2018-0111—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the applicatioEPSS 1.7%