Falhas do tipo CWE-200

4.979 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2024-32387MEDIUMAn issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via thEPSS 0.3%CVE-2026-55188HIGHRustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentialsEPSS 0.3%CVE-2024-52001MEDIUMPortal user is able to access forbidden services information in Combodo iTopEPSS 0.3%CVE-2026-83354MEDIUMVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.EPSS 0.3%CVE-2026-79122MEDIUMInformation leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted netEPSS 0.3%CVE-2025-13758LOWExposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.EPSS 0.3%CVE-2025-24089MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumeEPSS 0.3%CVE-2024-52032MEDIUMPrivate channel names leaking when Elasticsearch is enabledEPSS 0.3%CVE-2023-47616LOWA CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8EPSS 0.3%CVE-2026-1407LOWBeetel 777VR1 UART information disclosureEPSS 0.3%CVE-2026-79246MEDIUMInformation leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craEPSS 0.3%CVE-2025-14075MEDIUMWP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' ParameterEPSS 0.3%CVE-2025-4593MEDIUMWP Register Profile With Shortcode <= 3.6.2 - Authenticated (Contributor+) Sensitive Information ExposureEPSS 0.3%CVE-2024-36118LOWUnauthorized viewing of workspace test cases in MeterSphereEPSS 0.3%CVE-2024-34029MEDIUMAD/LDAP Group Members LeakEPSS 0.3%CVE-2018-0106—A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, local attacker to access EPSS 0.3%CVE-2026-14231MEDIUMLifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_postsEPSS 0.3%CVE-2026-78138MEDIUMFinale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_htmlEPSS 0.3%CVE-2026-1255HIGHYS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX ActionEPSS 0.3%CVE-2026-85572MEDIUMTutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment DisclosureEPSS 0.3%