Falhas do tipo CWE-200

5.714 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2020-5330HIGHDell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell EEPSS 13.3%CVE-2023-31185HIGHROZCOM server frameworkEPSS 12.8%CVE-2017-12373—A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could alloEPSS 12.8%CVE-2022-46650MEDIUMAcemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials EPSS 12.3%CVE-2022-20821MEDIUMCisco IOS XR Software Health Check Open Port VulnerabilityEPSS 11.5%KEVCVE-2026-50508MEDIUMWindows NTLM Spoofing VulnerabilityEPSS 11.4%CVE-2025-60344HIGHA path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate inpuEPSS 11.4%CVE-2022-0281HIGHExposure of Sensitive Information to an Unauthorized Actor in microweber/microweberEPSS 10.5%CVE-2024-54188MEDIUMInfoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access.EPSS 10.5%CVE-2026-34472HIGHUnauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attacEPSS 9.0%CVE-2024-33603MEDIUMThe LevelOne WBR-6012 router has an information disclosure vulnerability in its web application, which allows unauthenticated users to accesEPSS 8.6%CVE-2023-34261—Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they EPSS 8.1%CVE-2018-3646MEDIUMSystems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residEPSS 8.1%CVE-2018-15964HIGHAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with EPSS 7.9%CVE-2017-12163MEDIUMAn information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.EPSS 7.6%CVE-2026-20805MEDIUMDesktop Window Manager Information Disclosure VulnerabilityEPSS 7.5%KEVCVE-2021-40690—Bypass of the secureValidation propertyEPSS 7.4%CVE-1999-0511CRITICALIP forwarding is enabled on a machine which is not a router or firewall.EPSS 7.0%CVE-2025-53694HIGHInformation Disclosure in ItemServices APIEPSS 6.9%CVE-2021-24227—Patreon WordPress < 1.7.0 - Unauthenticated Local File DisclosureEPSS 6.8%