Fallos del tipo CWE-200

4915 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-1999-0632HIGHThe RPC portmapper service is running.EPSS 1.0%CVE-2019-18332—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 1.0%CVE-2021-31918—A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stackEPSS 1.0%CVE-2021-34774MEDIUMCisco Common Services Platform Collector Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-42907MEDIUMWindows Shell Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-47655MEDIUMMicrosoft Graph Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-49159MEDIUMMicrosoft Graph Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-32151MEDIUMWindows Shell Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-40374MEDIUMMicrosoft Power Automate Desktop Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-66301MEDIUMMicrosoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-45236MEDIUMPredictable TCP ISNs in EDK II Network PackageEPSS 1.0%CVE-2024-22275MEDIUMThe vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance sheEPSS 1.0%CVE-2022-42852MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPaEPSS 1.0%CVE-2020-35167MEDIUMDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable TimEPSS 1.0%CVE-2025-49671MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-34589HIGHBender Charge Controller: RFID leakEPSS 1.0%CVE-2020-36532MEDIUMKlapp App Authorization Credentials information disclosureEPSS 1.0%CVE-2025-31279CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.EPSS 1.0%CVE-2021-22001—In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request oEPSS 1.0%CVE-2022-29567MEDIUMPossible information disclosure inside TreeGrid component with default data providerEPSS 1.0%