Fallos del tipo CWE-200

4927 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2026-42880CRITICALArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionEPSS 0.6%CVE-2021-44534MEDIUMInsufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosEPSS 0.6%CVE-2025-34051MEDIUMAVTECH DVR Devices Server-Side Request ForgeryEPSS 0.6%CVE-2026-46584LOWApache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parametersEPSS 0.6%CVE-2024-1255MEDIUMsepidz SepidzDigitalMenu Waiters information disclosureEPSS 0.6%CVE-2023-22086HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.6%CVE-2017-9369LOWIn BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the defaulEPSS 0.6%CVE-2026-84142CRITICALInternally found bugs fixed in Thunderbird 155EPSS 0.6%CVE-2026-19229MEDIUMSourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosureEPSS 0.6%CVE-2024-25118MEDIUMInformation Disclosure of Hashed Passwords in TYPO3 Backend FormsEPSS 0.6%CVE-2025-61594LOWURI Credential Leakage Bypass over CVE-2025-27221EPSS 0.6%CVE-2022-3460HIGHIn affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed EPSS 0.6%CVE-2025-65717MEDIUMAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML pEPSS 0.6%CVE-2026-36355HIGHThe rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access controEPSS 0.6%CVE-2026-54203CRITICALTeamDavid: Memory Leak leaking sensitive informationEPSS 0.6%CVE-2021-3800—A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users toEPSS 0.6%CVE-2024-50312MEDIUMGraphql: information disclosure via graphql introspection in openshiftEPSS 0.6%CVE-2026-29066MEDIUMArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLIEPSS 0.6%CVE-2026-56238HIGHCapgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointEPSS 0.6%CVE-2026-81732MEDIUMWWBN AVideo through 30.0 Information Disclosure via report4.json.phpEPSS 0.6%