Fallos del tipo CWE-312

502 resultados

Divulgação de Informações Sensíveis

É quando a aplicação expõe dados sensíveis (senhas, tokens, dados pessoais, chaves de API) de forma não intencional — seja em logs, respostas de erro, memória, ou tráfego de rede. O risco é que um atacante, desenvolvedor mal-intencionado ou até um usuário comum consegue acessar informações que deveriam estar protegidas.

Ejemplo

Uma API retorna a senha do usuário em texto plano na resposta JSON de erro; um servidor deixa stack traces detalhados visíveis em páginas de erro 500, revelando caminhos internos e bibliotecas usadas; ou um formulário de login inclui o token de sessão como parâmetro GET em logs de proxy.

Cómo mitigar

Nunca logarque dados sensíveis; sanitize mensagens de erro para o cliente (mostre apenas identificadores genéricos); use variáveis de ambiente para secrets e nunca as commite; implemente logs estruturados apenas no servidor, sem expô-los. Revise regularmente o que sua app entrega em respostas, headers e logs.

CVE-2020-7517—A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow EPSS 0.2%CVE-2026-43992CRITICALJunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameterEPSS 0.2%CVE-2026-27520HIGHBinardat 10G08-0800GSM Network Switch Base64-encoded Password Stored in CookieEPSS 0.2%CVE-2019-25279MEDIUMFaceSentry Access Control System 6.4.8 Cleartext Password Storage VulnerabilityEPSS 0.2%CVE-2024-8689MEDIUMActiveMQ Content Pack: Cleartext Exposure of CredentialsEPSS 0.2%CVE-2024-45744LOWTopQuadrant TopBraid EDG password manager stores external credentials insecurelyEPSS 0.2%CVE-2026-32842HIGHEdimax GS-5008PL <= 1.00.54 Admin Credentials Stored in CleartextEPSS 0.2%CVE-2026-44940MEDIUMService token exposure and potential privilege escalation in SUSE ObservabilityEPSS 0.2%CVE-2024-31587MEDIUMSecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a EPSS 0.2%CVE-2025-4394MEDIUMMedtronic MyCareLink Patient Monitor Unencrypted Filesystem VulnerabilityEPSS 0.2%CVE-2026-55885MEDIUMGrav: Admin Backup Zip File Exposes Account Credentials and Configuration SecretsEPSS 0.2%CVE-2022-39351MEDIUMDependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissionsEPSS 0.2%CVE-2024-36589MEDIUMAn issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd81EPSS 0.2%CVE-2020-25677—A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allowEPSS 0.2%CVE-2026-76383MEDIUMInformation Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAREPSS 0.2%CVE-2020-7516—A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allowEPSS 0.2%CVE-2024-35117MEDIUMIBM OpenPages with Watson information disclosureEPSS 0.2%CVE-2026-123059HIGHKeycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEPSS 0.2%CVE-2026-123047HIGHKeycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEPSS 0.2%CVE-2024-24488MEDIUMAn issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password cEPSS 0.2%