Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2019-15592—GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associatEPSS 1.0%CVE-2022-41707MEDIUMRelatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. TEPSS 1.0%CVE-2022-24784LOWDiscoverability of user password hash in Statamic CMSEPSS 1.0%CVE-2021-21301LOWVideo feed was captured while user has disabled videoEPSS 1.0%CVE-2022-22183HIGHJunos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.EPSS 1.0%CVE-2021-32473—It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to EPSS 1.0%CVE-2021-4377MEDIUMDoneren met Mollie <= 2.8.4 - Information DisclosureEPSS 1.0%CVE-2019-15579—An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where thEPSS 1.0%CVE-2018-25081HIGHBitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have beEPSS 1.0%CVE-2024-21501MEDIUMVersions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attriEPSS 1.0%CVE-2026-47633HIGHMicrosoft Cost Management Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-26054MEDIUMCredentials inlined to Git URLs could end up in provenance attestation in BuildKitEPSS 1.0%CVE-2025-59284LOWWindows NTLM Spoofing VulnerabilityEPSS 1.0%CVE-2019-18334—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2019-18331—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2026-53959MEDIUM4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated userEPSS 1.0%CVE-2019-18335—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2019-18333—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2022-43959MEDIUMInsufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to EPSS 1.0%CVE-2026-45793HIGHComposer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logsEPSS 1.0%