Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2023-39042—An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%CVE-2023-39057—An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%CVE-2023-39050—An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%CVE-2023-39048—An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.EPSS 0.7%CVE-2023-44394MEDIUMDisclosure of project names to unauthorized users in MantisBTEPSS 0.7%CVE-2022-46081HIGHIn Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal inforEPSS 0.7%CVE-2023-40691MEDIUMIBM Cloud Pak for Business Automation information disclosureEPSS 0.7%CVE-2024-0490MEDIUMHuaxia ERP getAllList information disclosureEPSS 0.7%CVE-2024-3870MEDIUMContact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information ExposureEPSS 0.7%CVE-2022-35246MEDIUMA NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl MeteEPSS 0.7%CVE-2021-32477—The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capabilEPSS 0.7%CVE-2022-42883MEDIUMWordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerabilityEPSS 0.7%CVE-2023-40276CRITICALAn issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFileEPSS 0.7%CVE-2024-30300CRITICALTenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS WorkerEPSS 0.7%CVE-2023-33979MEDIUMgpt_academic's Configuration File vulnerable to File Information DisclosureEPSS 0.7%CVE-2021-22527MEDIUMInformation leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1EPSS 0.7%CVE-2023-47146MEDIUMIBM QRadar SIEM information disclosureEPSS 0.7%CVE-2025-14286MEDIUMTenda AC9 Configuration File DownloadCfg.jpg information disclosureEPSS 0.7%CVE-2023-51142HIGHAn issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.EPSS 0.7%CVE-2023-0838MEDIUMAn issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A EPSS 0.7%