Fallos del tipo CWE-200

4985 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2026-19439HIGHUltimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_detailsEPSS 0.3%CVE-2021-22276MEDIUMfree@home System Access Point FW integrity check can be bypassed.EPSS 0.3%CVE-2026-96255HIGHPayments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug LogEPSS 0.3%CVE-2026-100687HIGHBudibase Server before 3.45.0 Credential Exposure via External Table BroadcastEPSS 0.3%CVE-2026-19715HIGHWP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log FileEPSS 0.3%CVE-2024-31799MEDIUMInformation Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via thEPSS 0.3%CVE-2025-24262MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. A sandboxed aEPSS 0.3%CVE-2025-20377MEDIUMCisco Unified Intelligence Center API Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-12677MEDIUMKiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key ExposureEPSS 0.3%CVE-2026-100244HIGHCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)EPSS 0.3%CVE-2024-4220MEDIUMInformation Disclosure in BeyondInsightEPSS 0.3%CVE-2025-61164HIGHCohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.EPSS 0.3%CVE-2025-12584MEDIUMQuick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product DisclosureEPSS 0.3%CVE-2025-12098MEDIUMAcademy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'EPSS 0.3%CVE-2025-13215MEDIUMShortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information ExposureEPSS 0.3%CVE-2022-32849MEDIUMAn information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big SuEPSS 0.3%CVE-2024-23104MEDIUMAn exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNEPSS 0.3%CVE-2025-12141LOWGrafana Alerting Editors can edit destination of webhooks they did not createEPSS 0.3%CVE-2025-24280MEDIUMAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app mEPSS 0.3%CVE-2026-93383MEDIUMInformation leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.3%