Fallos del tipo CWE-215

18 resultados

Exposição de informações sensíveis em código de depuração

Desenvolvedores deixam dados sensíveis (senhas, tokens, chaves de API, PII) em logs, mensagens de erro ou modo debug que acabam acessíveis em produção. É perigoso porque essas informações podem vazar em arquivos de log públicos, páginas de erro expostas ou dumps de memória, comprometendo a segurança do sistema.

Ejemplo

Um desenvolvedor adiciona um `console.log(user.password)` durante testes de autenticação e esquece de remover antes do deploy. Quando o sistema é acessado, qualquer pessoa que capturar o tráfego de rede ou inspecionar a página vê a senha em texto plano no console do navegador ou nos logs do servidor.

Cómo mitigar

Nunca registre dados sensíveis em logs ou mensagens de erro — use placeholders ou hashes. Implemente code review obrigatório antes do merge, configure sanitização automática de logs (mascarar senhas, tokens) e desative modo debug em produção. Use secrets management tools (Vault, AWS Secrets Manager) para credenciais.

CVE-2024-7569CRITICALAn information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated atEPSS 1.7%CVE-2022-0721HIGHInsertion of Sensitive Information Into Debugging Code in microweber/microweberEPSS 1.4%CVE-2019-3781HIGHCF CLI does not sanitize user's password in verbose/trace/debugEPSS 1.3%CVE-2018-1002104MEDIUMVersions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.EPSS 1.1%CVE-2018-1191—Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may bEPSS 0.9%CVE-2025-34081MEDIUMCONPROSYS HMI System (CHS) < 3.7.7 Exposed PHP Debug InfoEPSS 0.6%CVE-2025-27684HIGHVasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive DataEPSS 0.6%CVE-2025-12616MEDIUMPHPGurukul News Portal settings.py insertion of sensitive information into debugging codeEPSS 0.5%CVE-2023-49194MEDIUMWordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2026-40173CRITICALDgraph: Unauthenticated pprof endpoint leaks admin auth tokenEPSS 0.5%CVE-2026-33247HIGHNATS credentials are exposed in monitoring port via command-line argvEPSS 0.4%CVE-2024-22194LOWcdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration codeEPSS 0.4%CVE-2026-2250HIGHUnauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WICEPSS 0.4%CVE-2023-51390MEDIUMInformation Disclosure Vulnerability in JournalpumpEPSS 0.3%CVE-2025-58598MEDIUMWordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2025-0895LOWIBM Cognos Mobile information disclosureEPSS 0.2%CVE-2023-21462MEDIUMThe sensitive information exposure vulnerability in Quick Share Agent prior to versions 3.5.14.18 in Android 12 and 3.5.16.20 in Android 13 EPSS 0.2%CVE-2026-44934HIGHExposed tokens in SUSE Rancher AI Agent logsEPSS 0.1%