Fallos del tipo CWE-212

88 resultados

Divulgação de informações sensíveis

A aplicação expõe dados que não deveria (senhas, tokens, caminhos internos, versões de software) a usuários não autorizados, seja por erro de configuração, logging inadequado ou resposta de erro verbosa. O perigo está em dar ao atacante informações que facilitam exploração de outras vulnerabilidades ou comprometem a confidencialidade.

Ejemplo

Um servidor web retorna stack traces completos em páginas de erro, revelando caminhos absolutos do servidor e bibliotecas em uso; ou a aplicação exibe o token de sessão do usuário em logs do navegador acessíveis via JavaScript; ou uma API retorna mensagens de erro que confirmam quais usuários existem no sistema.

Cómo mitigar

Implemente tratamento genérico de erros (nunca exiba detalhes técnicos ao usuário final), revise logs e respostas da API para garantir que dados sensíveis não sejam registrados ou retornados, e use variáveis de ambiente para armazenar secrets em vez de hardcodá-los no código ou comentários.

CVE-2024-41156LOWProfile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers vaEPSS 0.4%CVE-2024-43384HIGHPhoenix Contact: Improper removal of sensitive information in MGUARD productsEPSS 0.3%CVE-2026-27640HIGHtfplan2md has Sensitive Value Exposure in Generated ReportsEPSS 0.3%CVE-2023-52376HIGHInformation management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.3%CVE-2026-43528HIGHOpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig AliasesEPSS 0.3%CVE-2025-48708MEDIUMgs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A createEPSS 0.3%CVE-2020-25635MEDIUMA flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is compleEPSS 0.3%CVE-2025-57757MEDIUMContao discloses information in the news moduleEPSS 0.3%CVE-2024-56353MEDIUMIn JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookiesEPSS 0.3%CVE-2022-23605MEDIUMExpired Ephemeral Messages not reliably removed in wire-webappEPSS 0.3%CVE-2026-90860HIGHThe Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVieEPSS 0.3%CVE-2025-59955MEDIUMCoolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpointEPSS 0.3%CVE-2026-107293LOWPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`EPSS 0.3%CVE-2026-1732MEDIUMImproper Removal of Sensitive Information Before Storage or Transfer in GitLabEPSS 0.3%CVE-2024-32028MEDIUMSensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreEPSS 0.3%CVE-2026-86740MEDIUMSnipe-IT before 8.7.0 Attachment Deletion Reports Success While File RemainsEPSS 0.3%CVE-2026-54421MEDIUMIn OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can returnEPSS 0.3%CVE-2025-62483MEDIUMZoom Clients - Improper Removal of Sensitive InformationEPSS 0.3%CVE-2024-29120MEDIUMApache StreamPark: Information leakage vulnerabilityEPSS 0.3%CVE-2026-39937HIGHGlobal vanishing does not completely remove user emailEPSS 0.3%