Fallos del tipo CWE-312

423 resultados

Divulgação de Informações Sensíveis

É quando a aplicação expõe dados sensíveis (senhas, tokens, dados pessoais, chaves de API) de forma não intencional — seja em logs, respostas de erro, memória, ou tráfego de rede. O risco é que um atacante, desenvolvedor mal-intencionado ou até um usuário comum consegue acessar informações que deveriam estar protegidas.

Ejemplo

Uma API retorna a senha do usuário em texto plano na resposta JSON de erro; um servidor deixa stack traces detalhados visíveis em páginas de erro 500, revelando caminhos internos e bibliotecas usadas; ou um formulário de login inclui o token de sessão como parâmetro GET em logs de proxy.

Cómo mitigar

Nunca logarque dados sensíveis; sanitize mensagens de erro para o cliente (mostre apenas identificadores genéricos); use variáveis de ambiente para secrets e nunca as commite; implemente logs estruturados apenas no servidor, sem expô-los. Revise regularmente o que sua app entrega em respostas, headers e logs.

CVE-2020-27986HIGHSonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE:EPSS 16.2%CVE-2016-8366—Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pEPSS 5.8%CVE-2020-5723—The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve allEPSS 5.7%CVE-2025-22896CRITICALmySCADA myPRO Manager Cleartext Storage of Sensitive InformationEPSS 3.4%CVE-2025-27532MEDIUMA vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attEPSS 3.3%CVE-2021-36782CRITICALRancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectEPSS 3.1%CVE-2026-22240CRITICALPlaintext Passwords Vulnerability in BLUVOYIXEPSS 3.0%CVE-2011-4723MEDIUMThe D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecifiEPSS 3.0%KEVCVE-2014-5433—An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on BaxtEPSS 2.1%CVE-2023-40238MEDIUMA LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.EPSS 1.9%CVE-2023-22894CRITICALStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. ThEPSS 1.7%CVE-2024-3742HIGHElectrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive InformationEPSS 1.4%CVE-2017-2672MEDIUMA flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log EPSS 1.2%CVE-2017-9663—An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. SuccEPSS 1.1%CVE-2017-9654—The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend syEPSS 1.1%CVE-2015-3952—Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and EPSS 1.0%CVE-2018-10871LOW389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica anEPSS 1.0%CVE-2020-9045CRITICALC•CURE 9000 and victor Video Management System - Cleartext storage of user credentials upon installation or upgrade of software.EPSS 1.0%CVE-2026-23655MEDIUMMicrosoft ACI Confidential Containers Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-21339MEDIUMCleartext storage of session identifierEPSS 0.9%