Falhas do tipo CWE-200

4.939 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2026-52203HIGHAn issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.EPSS 0.5%CVE-2026-39079HIGHAn issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /modEPSS 0.5%CVE-2023-5134MEDIUMEasy Registration Forms <= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via ShortcodeEPSS 0.5%CVE-2026-39007HIGHAn issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export comEPSS 0.5%CVE-2026-52474HIGHAn issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.EPSS 0.5%CVE-2026-73622HIGHGitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()EPSS 0.5%CVE-2023-25500LOWPossible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1EPSS 0.5%CVE-2025-32044HIGHMoodle: unauthenticated rest api user data exposureEPSS 0.5%CVE-2024-42435MEDIUMZoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Sensitive Information ExposureEPSS 0.5%CVE-2025-21620HIGHDeno's authorization headers not dropped when redirecting cross-originEPSS 0.5%CVE-2026-57474MEDIUMDeloitte AI Assist for Customer information disclosureEPSS 0.5%CVE-2024-39822MEDIUMZoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Sensitive Information ExposureEPSS 0.5%CVE-2026-20939MEDIUMWindows File Explorer Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-34905MEDIUMApache Answer: Unlisted Questions Accessible via Direct API AccessEPSS 0.5%CVE-2024-26477HIGHAn issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth,EPSS 0.5%CVE-2025-5436MEDIUMMultilaser Sirius RE016 cstecgi.cgi information disclosureEPSS 0.5%CVE-2026-32270LOWCraft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous paymentsEPSS 0.5%CVE-2026-20937MEDIUMWindows File Explorer Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-6429MEDIUMnetrc credential leak with reused proxy connectionEPSS 0.5%CVE-2022-37438LOWInformation disclosure via the dashboard drilldown in Splunk EnterpriseEPSS 0.5%