Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2024-23302HIGHCouchbase Server before 7.2.4 has a private key leak in goxdcr.log.EPSS 0.7%CVE-2026-49336MEDIUM@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapterEPSS 0.7%CVE-2020-12518MEDIUMPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.EPSS 0.7%CVE-2025-26795HIGHApache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driverEPSS 0.7%CVE-2023-4796MEDIUMBooster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via ShortcodeEPSS 0.7%CVE-2025-26864HIGHApache IoTDB: Exposure of Sensitive Information in IoTDB OpenID AuthenticationEPSS 0.7%CVE-2023-49981HIGHA directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the EPSS 0.7%CVE-2023-20055HIGHCisco DNA Center Privilege Escalation VulnerabilityEPSS 0.7%CVE-2023-32082LOWetcd key name can be accessed via LeaseTimeToLive APIEPSS 0.7%CVE-2020-7262MEDIUMImproper Access Control vulnerability in ATDEPSS 0.7%CVE-2021-20250—A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on theEPSS 0.7%CVE-2023-28336—Moodle: teacher can access names of users they do not have permission to accessEPSS 0.7%CVE-2023-42454CRITICALSQLpage vulnerable to public exposure of database credentialsEPSS 0.7%CVE-2022-39230MEDIUMSecurity issue in fhir-works-on-aws-authz-smartEPSS 0.7%CVE-2026-4106MEDIUMHT Mega < 3.0.7 – Unauthenticated PII DisclosureEPSS 0.7%CVE-2023-1402—Moodle: course participation report shows roles the user should not seeEPSS 0.7%CVE-2023-39053—An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%CVE-2023-39042—An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%CVE-2023-39057—An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%CVE-2023-39050—An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%