Fallos del tipo CWE-200

5714 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2023-42781—Apache Airflow: Permission verification bypass allows viewing dagruns of other dagsEPSS 1.7%CVE-2021-41092MEDIUMDocker CLI leaks private registry credentials to registry-1.docker.ioEPSS 1.7%CVE-2022-24737MEDIUMExposure of Sensitive Information to an Unauthorized Actor in httpieEPSS 1.7%CVE-2024-54961MEDIUMNagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying theEPSS 1.6%CVE-2025-6984HIGHSensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchainEPSS 1.6%CVE-2021-21424MEDIUMPrevent user enumeration using Guard or the new Authenticator-based SecurityEPSS 1.6%CVE-2022-41876HIGHezplatform-graphql GraphQL queries can expose password hashesEPSS 1.6%CVE-2024-13609MEDIUM1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.phpEPSS 1.6%CVE-2018-13289MEDIUMInformation exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers tEPSS 1.6%CVE-2003-20001MEDIUMAn issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the login wait time and an eEPSS 1.6%CVE-2020-3498MEDIUMCisco Jabber for Windows Information Disclosure VulnerabilityEPSS 1.6%CVE-2023-41752HIGHApache Traffic Server: s3_auth plugin problem with hash calculationEPSS 1.6%CVE-2022-0709—Booking Package < 1.5.29 - Unauthenticated Sensitive Data DisclosureEPSS 1.6%CVE-2020-1757HIGHA flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unEPSS 1.6%CVE-2017-2651LOWjenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamicallyEPSS 1.6%CVE-2025-21242MEDIUMWindows Kerberos Information Disclosure VulnerabilityEPSS 1.6%CVE-2025-24011MEDIUMUmbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response CodesEPSS 1.6%CVE-2020-36723MEDIUMListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information DisclosureEPSS 1.6%CVE-2023-45348—Apache Airflow: Configuration information leakage vulnerabilityEPSS 1.6%CVE-2018-14782—NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allows access to configuration filEPSS 1.6%