Fallos del tipo CWE-359

213 resultados

Violação de Privacidade

Ocorre quando a aplicação expõe dados pessoais ou sensíveis sem consentimento do usuário, ou com controle de acesso inadequado. O risco é que informações privadas (credenciais, dados financeiros, localização, etc.) fiquem acessíveis a quem não deveria ter acesso.

Ejemplo

Uma API retorna token de sessão, ID de usuário ou dados de perfil em URLs, logs públicos, ou respostas de erro visíveis; ou um endpoint de listar usuários não valida permissões, permitindo qualquer cliente enumerar dados sensíveis de terceiros.

Cómo mitigar

Implemente controle de acesso granular em cada endpoint sensível; nunca exponha dados pessoais em URLs, logs ou respostas de erro; criptografe dados em trânsito e em repouso; aplique princípio do menor privilégio e audite acessos regularmente.

CVE-2023-48680LOWSensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber ProteEPSS 0.2%CVE-2023-44213LOWSensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber ProteEPSS 0.2%CVE-2025-11598LOWExposure of Confidential Information in mObywatel applicationEPSS 0.2%CVE-2026-28963MEDIUMA privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical acEPSS 0.2%CVE-2025-52602MEDIUMHCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query applicationEPSS 0.2%CVE-2026-21827LOWHCL Connections is vulnerable to an information disclosure vulnerabilityEPSS 0.2%CVE-2025-6017MEDIUMRhacm: users with clusterreader role can see credentials from managed-clustersEPSS 0.1%CVE-2026-54565MEDIUMrhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pagesEPSS 0.1%CVE-2025-35981MEDIUMExposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to vieEPSS 0.1%CVE-2025-5009LOWInformation Disclosure in Gemini iOS AppEPSS 0.1%CVE-2025-30459MEDIUMA privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensiEPSS 0.1%CVE-2025-10859MEDIUMData stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabsEPSS 0.1%CVE-2026-24078MEDIUMExposure of Private Personal Information to an Unauthorized Actor in Data ModemEPSS 0.1%