Fallos del tipo CWE-200

5032 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2018-9384MEDIUMIn multiple locations, there is a possible way to bypass KASLR due to an unusual root cause. This could lead to local information disclosureEPSS 0.1%CVE-2026-79817MEDIUMLocal Disclosure of Sensitive Information in HPE Networking ClearPass Policy Manager Client SoftwareEPSS 0.1%CVE-2021-25392MEDIUMImproper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive infoEPSS 0.1%CVE-2022-33686LOWExposure of Sensitive Information in GsmAlarmManager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log.EPSS 0.1%CVE-2024-56193MEDIUMThere is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure witEPSS 0.1%CVE-2025-48527MEDIUMIn multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the code. This could lead tEPSS 0.1%CVE-2026-0305MEDIUMPrisma Access Agent: Information Disclosure Vulnerability on LinuxEPSS 0.1%CVE-2022-33693LOWExposure of Sensitive Information in CID Manager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log.EPSS 0.1%CVE-2018-9379MEDIUMIn multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a confused deputy. ThisEPSS 0.1%CVE-2022-33687LOWExposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log.EPSS 0.1%CVE-2022-33698LOWExposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log.EPSS 0.1%CVE-2022-33699LOWExposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via lEPSS 0.1%CVE-2022-33700LOWExposure of Sensitive Information in putDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via lEPSS 0.1%CVE-2025-58305MEDIUMIdentity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability may affect service coEPSS 0.1%CVE-2024-45447MEDIUMAccess control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confideEPSS 0.1%CVE-2025-22430MEDIUMIn isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This cEPSS 0.1%CVE-2025-48642MEDIUMIn jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local infoEPSS 0.1%CVE-2022-24001LOWInformation disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via EdEPSS 0.1%CVE-2021-25486LOWExposure of information vulnerability in ipcdump prior to SMR Oct-2021 Release 1 allows an attacker detect device information via analyzing EPSS 0.1%CVE-2025-68959MEDIUMPermission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect sEPSS 0.1%