Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2022-25602HIGHWordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerabilityEPSS 1.3%CVE-2018-16477—A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposEPSS 1.3%CVE-2018-13290MEDIUMInformation exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users tEPSS 1.3%CVE-2018-13292MEDIUMInformation exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticaEPSS 1.3%CVE-2022-24867HIGHLDAP password exposure in glpiEPSS 1.3%CVE-2022-23067HIGHToolJet - Token Leakage via Referer HeaderEPSS 1.3%CVE-2014-0778—Progea Movicon SCADA Exposure of Sensitive Information to an Unauthorized ActorEPSS 1.3%CVE-2020-3391MEDIUMCisco Digital Network Architecture Center Information Disclosure VulnerabilityEPSS 1.3%CVE-2019-3992—ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the serverEPSS 1.3%CVE-2023-26049LOWCookie parsing of quoted values can exfiltrate values from other cookies in Eclipse JettyEPSS 1.3%CVE-2022-0813MEDIUMPhpMyAdmin exposure of sensitive informationEPSS 1.3%CVE-2020-1628MEDIUMJunos OS: EX4300: Traffic from the network internal to the device (128.0.0.0) may be forwarded to egress interfacesEPSS 1.3%CVE-2023-42846—This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS EPSS 1.3%CVE-2017-6709—A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access adminisEPSS 1.3%CVE-2022-0430LOWExposure of Sensitive Information to an Unauthorized Actor in httpie/httpieEPSS 1.3%CVE-2021-21435MEDIUMInformation exposure in PDF exportEPSS 1.3%CVE-2018-13294MEDIUMInformation exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated usEPSS 1.3%CVE-2018-13295MEDIUMInformation exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authentEPSS 1.3%CVE-2016-6539—TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device IDEPSS 1.3%CVE-2026-53598HIGHPrompty: Arbitrary File Read via ${file:path} Reference ExpansionEPSS 1.3%