Fallos del tipo CWE-312

470 resultados

Divulgação de Informações Sensíveis

É quando a aplicação expõe dados sensíveis (senhas, tokens, dados pessoais, chaves de API) de forma não intencional — seja em logs, respostas de erro, memória, ou tráfego de rede. O risco é que um atacante, desenvolvedor mal-intencionado ou até um usuário comum consegue acessar informações que deveriam estar protegidas.

Ejemplo

Uma API retorna a senha do usuário em texto plano na resposta JSON de erro; um servidor deixa stack traces detalhados visíveis em páginas de erro 500, revelando caminhos internos e bibliotecas usadas; ou um formulário de login inclui o token de sessão como parâmetro GET em logs de proxy.

Cómo mitigar

Nunca logarque dados sensíveis; sanitize mensagens de erro para o cliente (mostre apenas identificadores genéricos); use variáveis de ambiente para secrets e nunca as commite; implemente logs estruturados apenas no servidor, sem expô-los. Revise regularmente o que sua app entrega em respostas, headers e logs.

CVE-2023-24442MEDIUMJenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar pEPSS 0.2%CVE-2024-21993MEDIUMInformation Disclosure Vulnerability in SnapCenterEPSS 0.2%CVE-2024-28810MEDIUMAn issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @CT application) allowsEPSS 0.2%CVE-2019-25279MEDIUMFaceSentry Access Control System 6.4.8 Cleartext Password Storage VulnerabilityEPSS 0.2%CVE-2026-61928MEDIUMWindows Hello Tampering VulnerabilityEPSS 0.2%CVE-2024-8689MEDIUMActiveMQ Content Pack: Cleartext Exposure of CredentialsEPSS 0.2%CVE-2024-45744LOWTopQuadrant TopBraid EDG password manager stores external credentials insecurelyEPSS 0.2%CVE-2023-28912MEDIUMCleartext Phonebook InformationEPSS 0.2%CVE-2026-44940MEDIUMService token exposure and potential privilege escalation in SUSE ObservabilityEPSS 0.2%CVE-2024-31587MEDIUMSecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a EPSS 0.2%CVE-2020-7517—A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow EPSS 0.2%CVE-2025-7738MEDIUMPython3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aapEPSS 0.2%CVE-2026-76383MEDIUMInformation Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAREPSS 0.2%CVE-2020-25677—A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allowEPSS 0.2%CVE-2025-1499MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.2%CVE-2024-36589MEDIUMAn issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd81EPSS 0.2%CVE-2026-33026CRITICALnginx-ui Backup Restore Allows Tampering with Encrypted BackupsEPSS 0.2%CVE-2024-35117MEDIUMIBM OpenPages with Watson information disclosureEPSS 0.2%CVE-2024-24488MEDIUMAn issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password cEPSS 0.2%CVE-2025-53742MEDIUMJenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, EPSS 0.2%