Fallos del tipo CWE-200

4927 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2022-24003MEDIUMExposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access internal data of Bixby EPSS 0.6%CVE-2026-2147MEDIUMTenda AC21 Web Management DownloadLog information disclosureEPSS 0.6%CVE-2025-61780MEDIUMRack has Possible Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-42164CRITICALMahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows EPSS 0.6%CVE-2026-25219MEDIUMApache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view accessEPSS 0.6%CVE-2022-32836—This issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to accessEPSS 0.6%CVE-2024-6560MEDIUMAddonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path DislcosureEPSS 0.6%CVE-2023-46820MEDIUMWordPress Image Regenerate & Select Crop Plugin <= 7.3.0 is vulnerable to Sensitive Data ExposureEPSS 0.6%CVE-2025-57441CRITICALThe Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on portEPSS 0.6%CVE-2022-38456MEDIUMWordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data ExposureEPSS 0.6%CVE-2024-41108HIGHFOG Sensitive Information DisclosureEPSS 0.6%CVE-2022-32784—The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafEPSS 0.6%CVE-2023-28334MEDIUMMoodle: users' name enumeration possible via idor on learning plans pageEPSS 0.6%CVE-2024-37115HIGHWordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerabilityEPSS 0.6%CVE-2026-15012MEDIUMDemi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory CopyEPSS 0.6%CVE-2024-48310HIGHAutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys tEPSS 0.6%CVE-2022-41914LOWNon-constant-time SCIM token comparison in Zulip ServerEPSS 0.6%CVE-2024-33436MEDIUMAn issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS variablesEPSS 0.6%CVE-2024-37110HIGHWordPress WishList Member X plugin < 3.26.7 - Unauthenticated Settings & Users Data Dump vulnerabilityEPSS 0.6%CVE-2024-46979MEDIUMData leak of notification filters of users in XWiki PlatformEPSS 0.5%