Falhas do tipo CWE-202

49 resultados

Exposição de informações sensíveis através de consultas de dados

Ocorre quando uma aplicação expõe dados sensíveis (senhas, tokens, informações pessoais) ao processar ou retornar resultados de consultas — seja em APIs, logs, mensagens de erro ou respostas a buscas. O desenvolvedor não filtra ou mascara adequadamente o que sai do sistema, permitindo que um atacante intercepte ou consulte diretamente essas informações.

Exemplo

Uma API de busca de usuários retorna resultado como {"id": 123, "nome": "João", "email": "joao@mail.com", "senha_hash": "abc123def", "token_api": "xyz789"}. Um atacante enumera IDs e coleta credenciais diretamente das respostas da busca.

Como mitigar

Implemente whitelist de campos retornáveis em consultas (retorne apenas id, nome, email — nunca senha ou tokens). Use serializers/DTOs que excluam explicitamente dados sensíveis, e valide permissões do usuário antes de expor qualquer informação em respostas.

CVE-2024-20388MEDIUMA vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote atEPSS 0.5%CVE-2024-13255HIGHRESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019EPSS 0.5%CVE-2026-40245HIGHFree5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authenticationEPSS 0.5%CVE-2026-70473HIGHFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyEPSS 0.5%CVE-2026-42797MEDIUMApache Syncope: JexlContextBuilder Information DisclosureEPSS 0.4%CVE-2021-1372MEDIUMCisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-38897MEDIUMWAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.EPSS 0.4%CVE-2026-25050LOWVendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyEPSS 0.4%CVE-2025-29981HIGHDell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An EPSS 0.4%CVE-2024-38895MEDIUMWAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.EPSS 0.4%CVE-2024-38892MEDIUMAn issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.EPSS 0.4%CVE-2026-77883MEDIUMApache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylistEPSS 0.4%CVE-2026-40533MEDIUMAn exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69EPSS 0.4%CVE-2025-36575HIGHDell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An uEPSS 0.4%CVE-2024-2088HIGHNextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information ExposureEPSS 0.3%CVE-2025-64504MEDIUMLangfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIsEPSS 0.3%CVE-2026-79633HIGHApache Answer: Missing Authorization Allows Mutations of Non-Public ContentEPSS 0.3%CVE-2025-64528MEDIUMUsers are able to find users by name even when `enable_names` is offEPSS 0.3%CVE-2026-103440LOWpagetriagelist discloses suppressed reviewer usernamesEPSS 0.3%CVE-2026-79613MEDIUMApache Answer: Disclosure of Comments on Non-Public Content Through Public ProfilesEPSS 0.3%