Fallos del tipo CWE-200

5714 resultados

Exposição de Informação Sensível

A aplicação divulga dados sensíveis (senhas, tokens, dados pessoais, chaves) para usuários ou sistemas que não têm autorização para acessá-los. Isso acontece por falta de controle de acesso adequado, logging verboso, erro de configuração ou simplesmente porque o dado fica visível em lugares errados — como mensagens de erro, logs públicos ou respostas HTTP.

Ejemplo

Um endpoint que lista pedidos expõe o CPF de outros clientes na resposta JSON sem validar se aquele usuário tem permissão; ou uma página de erro de servidor exibe o caminho completo dos arquivos e credenciais do banco de dados; ou a API retorna tokens de sessão em histórico de navegação.

Cómo mitigar

Implemente controle de acesso baseado em papéis (RBAC), filtre sempre os dados retornados por contexto do usuário autenticado, nunca exponha informação sensível em logs ou mensagens de erro, e revise regularmente o que a API devolve em cada resposta — especialmente campos como senhas, chaves, CPFs e tokens.

CVE-2017-1000100MEDIUMWhen doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name EPSS 4.0%CVE-2020-8169—curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over thEPSS 3.9%CVE-2025-49741HIGHMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 3.9%CVE-2020-8284LOWA malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and tEPSS 3.9%CVE-2026-6770MEDIUMOther issue in the Storage: IndexedDB componentEPSS 3.9%CVE-2023-1258MEDIUMFlow-X disclosure of sensitive information to unauthenticated usersEPSS 3.9%CVE-2017-7526MEDIUMlibgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the leftEPSS 3.8%CVE-2022-2462MEDIUMTransposh WordPress Translation <= 1.0.9.6 - Sensitive Information DisclosureEPSS 3.8%CVE-2020-9733HIGHSensitive information disclosure possible in AEMEPSS 3.8%CVE-2017-15098—Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before EPSS 3.7%CVE-2016-6548—Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session tokenEPSS 3.7%CVE-1999-0468HIGHInternet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component.EPSS 3.6%CVE-2025-55976HIGHIntelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local netwEPSS 3.6%CVE-2019-5016CRITICALAn exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functioEPSS 3.6%CVE-2020-15086CRITICALPotential Remote Code Execution in TYPO3 with mediace extensionEPSS 3.6%CVE-2026-33829MEDIUMWindows Snipping Tool Spoofing VulnerabilityEPSS 3.5%CVE-2018-15919MEDIUMRemotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a targEPSS 3.5%CVE-2026-54617CRITICALGravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandlerEPSS 3.5%CVE-2018-5407—Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel EPSS 3.4%CVE-2018-0425—Cisco RV110W, RV130W, and RV215W Routers Management Interface Information Disclosure VulnerabilityEPSS 3.4%