Falhas do tipo CWE-200

4.919 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2020-5414MEDIUMApp Autoscaler logs credentialsEPSS 0.7%CVE-2023-42940MEDIUMA session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their EPSS 0.7%CVE-2022-3870MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 beforeEPSS 0.7%CVE-2026-0789MEDIUMALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-20821MEDIUMRemote Procedure Call Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2024-35178HIGHJupyter server on Windows discloses Windows user password hashEPSS 0.7%CVE-2023-41260—Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API callEPSS 0.7%CVE-2022-46081HIGHIn Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal inforEPSS 0.7%CVE-2022-20811MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesEPSS 0.7%CVE-2026-5571MEDIUMTechnostrobe HI-LED-WR120-G2 Configuration Data fs information disclosureEPSS 0.7%CVE-2023-0658MEDIUMMultilaser RE057/RE170 Backup File param.file.tgz information disclosureEPSS 0.7%CVE-2026-22016HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). EPSS 0.7%CVE-2024-22022HIGHVulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash EPSS 0.7%CVE-2026-61802MEDIUMWazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/configEPSS 0.7%CVE-2026-21515CRITICALAzure IoT Central Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-38113MEDIUMInformation Disclosure Vulnerability EPSS 0.7%CVE-2022-44589HIGHWordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data ExposureEPSS 0.7%CVE-2021-25652MEDIUMAvaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-34080MEDIUMMantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.7%