Falhas do tipo CWE-200

5.715 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2021-25110—Futurio Extra < 1.6.3 - Subscriber+ User Email Address DisclosureEPSS 0.9%CVE-2021-39163LOWAdding a private/unlisted room to a community exposes room metadata in an unauthorised manner.EPSS 0.9%CVE-2017-15138MEDIUMThe OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidentiaEPSS 0.9%CVE-2022-35296—Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive iEPSS 0.9%CVE-2022-42817MEDIUMA logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, watEPSS 0.9%CVE-2017-12310—A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sEPSS 0.9%CVE-2023-6101MEDIUMMaiwei Safety Production Control Platform Intelligent Monitoring ha.html information disclosureEPSS 0.9%CVE-2024-1139HIGHCluster-monitoring-operator: credentials leakEPSS 0.9%CVE-2022-41859HIGHIn freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantiallEPSS 0.9%CVE-2024-23321HIGHApache RocketMQ: Unauthorized Exposure of Sensitive DataEPSS 0.9%CVE-2023-0321CRITICALDisclosure of Sensitive Information on Campbell Scientific ProductsEPSS 0.9%CVE-2021-24164—Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key DisclosureEPSS 0.9%CVE-2022-31143MEDIUMLeak of sensitive information through login page error in GLPIEPSS 0.9%CVE-2023-5576HIGHMigration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret ExposureEPSS 0.9%CVE-2023-7094MEDIUMNetentsec NS-ASG Application Security Gateway nsasg6.0.tgz information disclosureEPSS 0.9%CVE-2023-40049MEDIUMWS_FTP Server Information Disclosure via Directory ListingEPSS 0.9%CVE-2026-48050HIGHArc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSEPSS 0.9%CVE-2025-30474MEDIUMApache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error messageEPSS 0.9%CVE-2026-21532HIGHAzure Function Information Disclosure VulnerabilityEPSS 0.9%CVE-2024-3689LOWZhejiang Land Zongheng Network Technology O2OA information disclosureEPSS 0.9%