Fallos del tipo CWE-200

5714 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2021-37704MEDIUMExposed phpinfo() in PhpFastCacheEPSS 5.1%CVE-2022-32221CRITICALWhen doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when thEPSS 5.1%CVE-2022-28614—read beyond bounds via ap_rwrite()EPSS 5.1%CVE-2018-10915HIGHA vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between coEPSS 5.1%CVE-2022-29901MEDIUMArbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)EPSS 5.0%CVE-2017-5262—In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive informEPSS 4.9%CVE-2017-7899—An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWAEPSS 4.7%CVE-2022-27849MEDIUMWordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerabilityEPSS 4.6%CVE-2021-39211MEDIUMDisclosure of GLPI and server information in telemetry endpointEPSS 4.5%CVE-2021-22898LOWcurl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurEPSS 4.5%CVE-2025-59434CRITICALCritical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript FunctionEPSS 4.4%CVE-2021-28163LOWIn Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink,EPSS 4.2%CVE-2017-7575CRITICALSchneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\EPSS 4.1%CVE-2019-14893HIGHA flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserializatEPSS 4.1%CVE-2026-41266HIGHFlowise: Sensitive Data Leak in public-chatbotConfigEPSS 4.1%CVE-2023-47117HIGHObject Relational Mapper Leak Vulnerability in Filtering Task in Label StudioEPSS 4.1%CVE-2024-25734HIGHAn issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid usernamEPSS 4.1%CVE-2023-45131HIGHUnauthenticated access to new private chat messages in DiscourseEPSS 4.0%CVE-2022-29244HIGHnpm packing does not respect root-level ignore files in workspacesEPSS 4.0%CVE-2025-14528MEDIUMD-Link DIR-803 Configuration getcfg.php information disclosureEPSS 4.0%