Falhas do tipo CWE-200

5.714 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2019-10217MEDIUMA flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fieldsEPSS 1.9%CVE-2019-15576—An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private syEPSS 1.9%CVE-2025-26667MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.9%CVE-2019-6574—A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions EPSS 1.8%CVE-2024-38020MEDIUMMicrosoft Outlook Spoofing VulnerabilityEPSS 1.8%CVE-2023-46288—Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is setEPSS 1.8%CVE-2019-7305MEDIUMeXtplorer exposes /usr and /etc/extplorer over HTTPEPSS 1.8%CVE-2022-39258HIGHmailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UIEPSS 1.8%CVE-2019-13523—In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to EPSS 1.8%CVE-2017-16539MEDIUMThe DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackeEPSS 1.8%CVE-2026-30928HIGHGlances Exposes Unauthenticated Configuration SecretsEPSS 1.8%CVE-2025-32395MEDIUMVite has an `server.fs.deny` bypass with an invalid `request-target`EPSS 1.8%CVE-2017-2606MEDIUMJenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that shouEPSS 1.8%CVE-2019-10195MEDIUMA flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thEPSS 1.8%CVE-2022-31673HIGHVMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can createEPSS 1.8%CVE-2022-43684CRITICALACL bypass in Reporting functionalityEPSS 1.8%CVE-2025-4751MEDIUMD-Link DI-7003GV2 index.data information disclosureEPSS 1.8%CVE-2022-31051MEDIUMExposure of Sensitive Information to an Unauthorized Actor in semantic-releaseEPSS 1.8%CVE-2018-1052—Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read aEPSS 1.8%CVE-2021-41082HIGHPrivate message title and participating users leaked in discourseEPSS 1.8%