Fallos del tipo CWE-312

502 resultados

Divulgação de Informações Sensíveis

É quando a aplicação expõe dados sensíveis (senhas, tokens, dados pessoais, chaves de API) de forma não intencional — seja em logs, respostas de erro, memória, ou tráfego de rede. O risco é que um atacante, desenvolvedor mal-intencionado ou até um usuário comum consegue acessar informações que deveriam estar protegidas.

Ejemplo

Uma API retorna a senha do usuário em texto plano na resposta JSON de erro; um servidor deixa stack traces detalhados visíveis em páginas de erro 500, revelando caminhos internos e bibliotecas usadas; ou um formulário de login inclui o token de sessão como parâmetro GET em logs de proxy.

Cómo mitigar

Nunca logarque dados sensíveis; sanitize mensagens de erro para o cliente (mostre apenas identificadores genéricos); use variáveis de ambiente para secrets e nunca as commite; implemente logs estruturados apenas no servidor, sem expô-los. Revise regularmente o que sua app entrega em respostas, headers e logs.

CVE-2024-58277HIGHR Radio Network FM Transmitter 1.07 System Settings DisclosureEPSS 0.4%CVE-2024-47529MEDIUMOpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)EPSS 0.4%CVE-2026-53603HIGHnebula-mesh: Operator session tokens stored in plaintext in the databaseEPSS 0.4%CVE-2025-8528MEDIUMExrick xboot getMenuList sensitive information in a cookieEPSS 0.4%CVE-2026-42151HIGHPrometheus Azure AD remote write OAuth client secret exposed via config APIEPSS 0.4%CVE-2023-6874HIGHZigbee Unauthenticated DoS via NWK Sequence number manipulationEPSS 0.4%CVE-2022-20660MEDIUMCisco IP Phones Information Disclosure VulnerabilityEPSS 0.4%CVE-2025-34200HIGHVasion Print (formerly PrinterLogic) Network Account Password Stored in CleartextEPSS 0.4%CVE-2026-86280MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sql cleartext storageEPSS 0.3%CVE-2024-36790HIGHNetgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.EPSS 0.3%CVE-2026-81321CRITICALCareCam CM2507 Cleartext Storage of Sensitive InformationEPSS 0.3%CVE-2025-27623MEDIUMJenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via RESTEPSS 0.3%CVE-2022-35279MEDIUM"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1EPSS 0.3%CVE-2024-7783MEDIUMImproper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llmEPSS 0.3%CVE-2025-30124CRITICALAn issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the existing password isEPSS 0.3%CVE-2024-46340CRITICALTL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plainteEPSS 0.3%CVE-2025-26495HIGHSensitive Data Exposure in Tableau ServerEPSS 0.3%CVE-2026-59657HIGHApache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJobEPSS 0.3%CVE-2024-8459HIGHPLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwordsEPSS 0.3%CVE-2023-27370MEDIUMNETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure VulnerabilityEPSS 0.3%