Fallos del tipo CWE-200

4915 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2020-5132—SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collisionEPSS 1.0%CVE-2023-6894MEDIUMHikvision Intercom Broadcasting System Log File system.html information disclosureEPSS 1.0%CVE-2023-22880MEDIUMInformation Disclosure in Zoom for Windows ClientsEPSS 1.0%CVE-2023-6757MEDIUMThecosy IceCMS API PlanetUser information disclosureEPSS 1.0%CVE-2025-3415MEDIUMGrafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected anEPSS 1.0%CVE-2025-30424CRITICALA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13EPSS 1.0%CVE-2024-7842MEDIUMSourceCodester Online Graduate Tracer System export_it.php information disclosureEPSS 1.0%CVE-2024-7843MEDIUMSourceCodester Online Graduate Tracer System exportcs.php information disclosureEPSS 1.0%CVE-2025-11368MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information ExposureEPSS 1.0%CVE-2023-47529MEDIUMWordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data ExposureEPSS 1.0%CVE-2022-21671HIGHPotential exposure of Replit tokens to an Unauthorized Actor in @replit/crosisEPSS 1.0%CVE-2024-42222MEDIUMApache CloudStack: Unauthorised Network List AccessEPSS 1.0%CVE-2007-3651MEDIUMclass/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) EPSS 1.0%CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2022-30197MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.0%CVE-2022-21683LOWComment reply notifications sent to incorrect users in wagtailEPSS 1.0%CVE-2021-41271MEDIUMCache poisoning via maliciously-formed request in discourseEPSS 1.0%CVE-2019-10175MEDIUMA flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determEPSS 1.0%CVE-2019-0048MEDIUMEX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may failEPSS 1.0%CVE-2023-36908MEDIUMWindows Hyper-V Information Disclosure VulnerabilityEPSS 1.0%