Fallos del tipo CWE-200

5715 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2023-39739HIGHThe leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted brEPSS 0.7%CVE-2022-47411CRITICALAn issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 tEPSS 0.7%CVE-2022-47410CRITICALAn issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 tEPSS 0.7%CVE-2023-39737HIGHThe leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messaEPSS 0.7%CVE-2023-39736HIGHThe leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted brEPSS 0.7%CVE-2013-10024LOWExit Strategy Plugin exitpage.php information disclosureEPSS 0.7%CVE-2021-4430LOWOrtus Solutions ColdBox Elixir ENV Variable defaultConfig.js information disclosureEPSS 0.7%CVE-2023-29106MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versiEPSS 0.7%CVE-2023-37868MEDIUMWordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data ExposureEPSS 0.7%CVE-2019-14820MEDIUMIt was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be EPSS 0.7%CVE-2025-59469CRITICALThis vulnerability allows a Backup or Tape Operator to write files as root.EPSS 0.7%CVE-2024-28236HIGHInsecure Variable Substitution in VelaEPSS 0.7%CVE-2024-47532HIGHRestrictedPython information leakage via `AttributeError.obj` and the `string` moduleEPSS 0.7%CVE-2025-13920MEDIUMWP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_actionEPSS 0.7%CVE-2022-4054MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5EPSS 0.7%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2023-34093MEDIUMStrapi allows actors to make all attributes on a content-type public without noticing itEPSS 0.7%CVE-2025-26521HIGHApache CloudStack: CKS cluster in project exposes user API keysEPSS 0.7%CVE-2023-35625MEDIUMAzure Machine Learning Compute Instance for SDK Users Information Disclosure VulnerabilityEPSS 0.7%CVE-2025-53156MEDIUMWindows Storage Port Driver Information Disclosure VulnerabilityEPSS 0.7%