Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2023-34131—Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker EPSS 0.8%CVE-2023-3553MEDIUMExposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampassEPSS 0.8%CVE-2023-49877MEDIUMIBM System Storage Virtualization Engine information disclosureEPSS 0.8%CVE-2022-43410MEDIUMJenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling throEPSS 0.8%CVE-2022-2401MEDIUMTeam members could access sensitive information of other users via an API callEPSS 0.8%CVE-2022-32218MEDIUMAn information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to alloEPSS 0.8%CVE-2026-25475MEDIUMOpenClaw Vulnerable to Local File Inclusion via MEDIA: Path ExtractionEPSS 0.8%CVE-2025-9808MEDIUMThe Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information DisclosureEPSS 0.8%CVE-2023-23327MEDIUMAn Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are storEPSS 0.8%CVE-2021-41158MEDIUMFreeSWITCH vulnerable to SIP digest leak for configured gatewaysEPSS 0.8%CVE-2026-69806HIGH.NET Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-4415MEDIUMA vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suEPSS 0.8%CVE-2025-68273MEDIUMSignal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed EndpointsEPSS 0.8%CVE-2024-47868MEDIUMSeveral components’ post-process steps may allow arbitrary file leaks in GradioEPSS 0.8%CVE-2022-24742MEDIUMExposure of Sensitive Information Due to Incompatible Policies in SyliusEPSS 0.8%CVE-2023-3231LOWUJCMS ZIP Package information disclosureEPSS 0.8%CVE-2019-9541—Telos Automated Message Handling System information disclosure in itemlookup.aspEPSS 0.8%CVE-2022-22545—A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWEPSS 0.8%CVE-2022-22409MEDIUMIBM Aspera Faspex information disclosureEPSS 0.8%CVE-2023-40580HIGHFreighter mnemonic phrase may be accessed by Javascript through a private APIEPSS 0.8%