Falhas do tipo CWE-200

5.715 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2021-32731MEDIUMThe reset password form reveal users email addressEPSS 1.2%CVE-2024-8852MEDIUMAll-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error LogsEPSS 1.2%CVE-2019-1692MEDIUMCisco Application Policy Infrastructure Controller Web-Based Management Interface Usage Information Disclosure VulnerabilityEPSS 1.2%CVE-2023-43796MEDIUMSynapse vulnerable to leak of remote user device informationEPSS 1.2%CVE-2023-40029CRITICALCluster secret might leak in cluster details page in Argo CDEPSS 1.2%CVE-2019-7005MEDIUMUnauthenticated Information Disclosure Vulnerability in IP OfficeEPSS 1.2%CVE-2024-46437MEDIUMA sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote aEPSS 1.2%CVE-2023-48796—Apache dolphinscheduler sensitive information disclosureEPSS 1.2%CVE-2026-55450CRITICALLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakEPSS 1.2%CVE-2023-39999MEDIUMWordPress < 6.3.2 is vulnerable to Broken Access ControlEPSS 1.2%CVE-2018-13291MEDIUMInformation exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenEPSS 1.2%CVE-2021-22137—In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. SearcEPSS 1.2%CVE-2021-29086MEDIUMExposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.EPSS 1.2%CVE-2018-13281MEDIUMInformation exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated useEPSS 1.2%CVE-2021-24585—Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username DisclosureEPSS 1.2%CVE-2022-1186MEDIUMBe POPIA Compliant <= 1.1.5 - Sensitive Information ExposureEPSS 1.2%CVE-2022-0722MEDIUMExposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-urlEPSS 1.2%CVE-2024-6633CRITICALInsecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)EPSS 1.2%CVE-2023-28271MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 1.2%CVE-1999-0632MEDIUMThe RPC portmapper service is running.EPSS 1.2%