Fallos del tipo CWE-200

5020 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2026-80356HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulEPSS 0.1%CVE-2025-50862MEDIUMThe Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB EPSS 0.1%CVE-2026-20619MEDIUMA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be ablEPSS 0.1%CVE-2025-67499MEDIUMCNI Plugins Portmap nftables backend intercepts non-local trafficEPSS 0.1%CVE-2022-44746LOWSensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office EPSS 0.1%CVE-2025-40768HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application exposes aEPSS 0.1%CVE-2026-60913LOWVulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that aEPSS 0.1%CVE-2025-48464MEDIUMExposure of Sensitive InformationEPSS 0.1%CVE-2026-45726HIGHOmni: Reader-level users can retrieve imported cluster CA keys via ResourceServiceEPSS 0.1%CVE-2026-61303LOWVulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are afEPSS 0.1%CVE-2026-60891LOWVulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that arEPSS 0.1%CVE-2025-58061MEDIUMOpenEBS Local PV RawFile persistent volume data is world readableEPSS 0.1%CVE-2025-20290MEDIUMCisco NXOS Software Sensitive Log Information Disclosure VulnerabilityEPSS 0.1%CVE-2025-43437LOWAn information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 26.1 and iPadOS 26.1. An app may beEPSS 0.1%CVE-2026-47514HIGHNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause exposure of kernEPSS 0.1%CVE-2026-20648MEDIUMA privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Tahoe 26.3. A malicious app mayEPSS 0.1%CVE-2026-24916MEDIUMIdentity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service EPSS 0.1%CVE-2025-31984LOWHCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” headerEPSS 0.1%CVE-2025-9381LOWFNKvision Y215 CCTV Camera wpa_supplicant.conf information disclosureEPSS 0.1%CVE-2026-75587LOWPlaintext pre-auth secret exposure via Desktop App diagnostics reportEPSS 0.1%