Falhas do tipo CWE-200

5.715 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2024-7328MEDIUMYouDianCMS information disclosureEPSS 0.7%CVE-2021-25652MEDIUMAvaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure VulnerabilityEPSS 0.7%CVE-2021-20018—A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. TEPSS 0.7%CVE-2024-35230MEDIUMWelcome and About GeoServer pages communicate version and revision informationEPSS 0.7%CVE-2026-79853CRITICALUnauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10EPSS 0.7%CVE-2026-0789MEDIUMALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure VulnerabilityEPSS 0.7%CVE-2025-15082MEDIUMTOZED ZLT M30s Web Management proc_post information disclosureEPSS 0.7%CVE-2023-48294MEDIUMBroken Access control on Graphs Feature in LibreNMSEPSS 0.7%CVE-2026-20821MEDIUMRemote Procedure Call Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-54151HIGHDirectus allows unauthenticated access to WebSocket events and operationsEPSS 0.7%CVE-2021-37867MEDIUMEmails of all users are exposed via one of the Boards APIsEPSS 0.7%CVE-2023-6105MEDIUMManageEngine Information Disclosure in Multiple ProductsEPSS 0.7%CVE-2025-53066HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). EPSS 0.7%CVE-2022-44589HIGHWordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data ExposureEPSS 0.7%CVE-2022-35169—SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decryptEPSS 0.7%CVE-2026-25186MEDIUMWindows Accessibility Infrastructure (ATBroker.exe) Information Disclosure VulnerabilityEPSS 0.7%CVE-2025-8226MEDIUMyanyutao0402 ChanCMS find information disclosureEPSS 0.7%CVE-2018-3826—In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameEPSS 0.7%CVE-2018-8863MEDIUMPhilips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.7%CVE-2024-29898MEDIUMOversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikisEPSS 0.7%