Fallos del tipo CWE-312

470 resultados

Divulgação de Informações Sensíveis

É quando a aplicação expõe dados sensíveis (senhas, tokens, dados pessoais, chaves de API) de forma não intencional — seja em logs, respostas de erro, memória, ou tráfego de rede. O risco é que um atacante, desenvolvedor mal-intencionado ou até um usuário comum consegue acessar informações que deveriam estar protegidas.

Ejemplo

Uma API retorna a senha do usuário em texto plano na resposta JSON de erro; um servidor deixa stack traces detalhados visíveis em páginas de erro 500, revelando caminhos internos e bibliotecas usadas; ou um formulário de login inclui o token de sessão como parâmetro GET em logs de proxy.

Cómo mitigar

Nunca logarque dados sensíveis; sanitize mensagens de erro para o cliente (mostre apenas identificadores genéricos); use variáveis de ambiente para secrets e nunca as commite; implemente logs estruturados apenas no servidor, sem expô-los. Revise regularmente o que sua app entrega em respostas, headers e logs.

CVE-2025-45001HIGHreact-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaEPSS 0.2%CVE-2025-59701MEDIUMEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physiEPSS 0.2%CVE-2025-56565HIGHDD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within noEPSS 0.2%CVE-2025-14377HIGHVerve Asset Manager – Plaintext Storage VulnerabilitiesEPSS 0.2%CVE-2024-39846LOWNewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitiEPSS 0.2%CVE-2025-12774MEDIUMSQL queries with sensitive information printed in logs with Brocade SANnav before 3.0EPSS 0.2%CVE-2022-35120HIGHIXPdata EasyInstall 6.6.14725 contains an access control issue.EPSS 0.2%CVE-2026-76381MEDIUMInformation Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAREPSS 0.2%CVE-2026-76380MEDIUMInformation Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAREPSS 0.2%CVE-2026-76377MEDIUMInformation Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAREPSS 0.2%CVE-2025-4394MEDIUMMedtronic MyCareLink Patient Monitor Unencrypted Filesystem VulnerabilityEPSS 0.2%CVE-2026-76378MEDIUMInformation Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAREPSS 0.2%CVE-2026-76386MEDIUMInformation Disclosure through Action Parameters in Zoom app for Splunk SOAREPSS 0.2%CVE-2026-76382MEDIUMInformation Disclosure through Action Parameters in Phantom app for Splunk SOAREPSS 0.2%CVE-2026-76379MEDIUMInformation Disclosure through Action Parameters in Cisco Webex app for Splunk SOAREPSS 0.2%CVE-2026-76384MEDIUMInformation Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAREPSS 0.2%CVE-2026-76376MEDIUMInformation Disclosure through Action Parameters in AWS IAM app for Splunk SOAREPSS 0.2%CVE-2026-76405MEDIUMInformation Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) appEPSS 0.2%CVE-2024-38877HIGHA vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All verEPSS 0.2%CVE-2021-3551—A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fiEPSS 0.2%