Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2023-34236HIGHInformation Disclosure Vulnerability in Weave GitOps Terraform ControllerEPSS 1.0%CVE-2021-22793—A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7)EPSS 1.0%CVE-2025-24408MEDIUMAdobe Commerce | Information Exposure (CWE-200)EPSS 1.0%CVE-2021-34125—An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via varioEPSS 1.0%CVE-2026-26273CRITICALKnown affected by Account Takeover via Password Reset Token LeakageEPSS 1.0%CVE-2022-39289CRITICALDatabase log access in ZoneMinderEPSS 1.0%CVE-2024-30096MEDIUMWindows Cryptographic Services Information Disclosure VulnerabilityEPSS 1.0%CVE-2024-0569MEDIUMTotolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosureEPSS 1.0%CVE-2025-59716MEDIUMownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insEPSS 1.0%CVE-2025-24102CRITICALThe issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 1EPSS 1.0%CVE-2022-32220MEDIUMAn information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messageEPSS 1.0%CVE-2021-22721—A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink ParkingEPSS 1.0%CVE-2019-10175MEDIUMA flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determEPSS 0.9%CVE-2025-56427HIGHDirectory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_EPSS 0.9%CVE-2017-6040—An Information Exposure issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. Non-sensitivEPSS 0.9%CVE-2022-24890LOWExposure of Private Personal Information to an Unauthorized Actor in Nextcloud TalkEPSS 0.9%CVE-2021-36095MEDIUMUser enumeration issue using "lost password" featureEPSS 0.9%CVE-2025-47855CRITICALAn exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3EPSS 0.9%CVE-2020-15080MEDIUMInformation disclosure in release archive in PrestaShopEPSS 0.9%CVE-2022-31134MEDIUMZulip Server public data export contains attachments that are non-publicEPSS 0.9%