Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2022-31134MEDIUMZulip Server public data export contains attachments that are non-publicEPSS 0.9%CVE-2021-42536HIGHEmerson WirelessHART GatewayEPSS 0.9%CVE-2024-21140MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotEPSS 0.9%CVE-2025-27736MEDIUMWindows Power Dependency Coordinator Information Disclosure VulnerabilityEPSS 0.9%CVE-2023-39620—An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via thEPSS 0.9%CVE-2022-27614MEDIUMExposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remEPSS 0.9%CVE-2022-42818MEDIUMThis issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. A user in a privileged network position mayEPSS 0.9%CVE-2022-31068MEDIUMSensitive Data Exposure on Refused Inventory Files in GLPIEPSS 0.9%CVE-2022-27630MEDIUMAn information disclosure vulnerability exists in the confctl_get_master_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A spEPSS 0.9%CVE-2022-27633MEDIUMAn information disclosure vulnerability exists in the confctl_get_guest_wlan functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specEPSS 0.9%CVE-2024-34788MEDIUMAn improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially senEPSS 0.9%CVE-2022-32741MEDIUMInformation disclosure in Request New Password featureEPSS 0.9%CVE-2023-5254MEDIUMAI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_userEPSS 0.9%CVE-2019-15963MEDIUMCisco Unified Communications Manager Information Disclosure VulnerabilityEPSS 0.9%CVE-2023-0557HIGHContentStudio <= 1.2.5 - Information ExposureEPSS 0.9%CVE-2022-2907MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 beforeEPSS 0.9%CVE-2026-0717MEDIUMLottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information ExposureEPSS 0.9%CVE-2019-17321—ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated with session, couldEPSS 0.9%CVE-2022-39030HIGHSmart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2EPSS 0.9%CVE-2023-41321MEDIUMSensitive fields enumeration through API in GLPIEPSS 0.9%