Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2021-42523—There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c sepEPSS 1.0%CVE-2021-34589HIGHBender Charge Controller: RFID leakEPSS 1.0%CVE-2021-22785HIGHA CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leEPSS 1.0%CVE-2019-11268MEDIUMUAA SQL Identity Zone VulnerabilityEPSS 1.0%CVE-2022-29241HIGHKnown or guessable hidden files may be accessed in Jupyter ServerEPSS 1.0%CVE-2021-22001—In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request oEPSS 1.0%CVE-2020-5132—SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collisionEPSS 1.0%CVE-2023-6894MEDIUMHikvision Intercom Broadcasting System Log File system.html information disclosureEPSS 1.0%CVE-2025-62206MEDIUMMicrosoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-6757MEDIUMThecosy IceCMS API PlanetUser information disclosureEPSS 1.0%CVE-2023-22880MEDIUMInformation Disclosure in Zoom for Windows ClientsEPSS 1.0%CVE-2022-40177—A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DEPSS 1.0%CVE-2022-4543MEDIUMA flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR bEPSS 1.0%CVE-2022-31032MEDIUMResources of private projects can be exposed in TuleapEPSS 1.0%CVE-2021-3644—A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressiEPSS 1.0%CVE-2025-6239MEDIUMInformation disclosureEPSS 1.0%CVE-2024-7843MEDIUMSourceCodester Online Graduate Tracer System exportcs.php information disclosureEPSS 1.0%CVE-2024-7842MEDIUMSourceCodester Online Graduate Tracer System export_it.php information disclosureEPSS 1.0%CVE-2023-38845—An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.EPSS 1.0%CVE-2023-38847—An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.EPSS 1.0%