Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-85315MEDIUMApache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer ExceptionsEPSS 0.5%CVE-2026-34045HIGHPodman Desktop WebView Server ExposedEPSS 0.5%CVE-2023-25687MEDIUMIBM Security Key Lifecycle Manager information disclosureEPSS 0.5%CVE-2026-69294MEDIUMMicrosoft COM for Windows Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-68886MEDIUMWindows Network Connection Broker Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-69684MEDIUMWindows Error Reporting Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-30614MEDIUMAn issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope.EPSS 0.5%CVE-2024-49818MEDIUMIBM Security Guardium Key Lifecycle Manager information disclosureEPSS 0.5%CVE-2026-64627MEDIUMParse Server 9.0.0 Schema Disclosure via GraphQL Variable CoercionEPSS 0.5%CVE-2022-46675MEDIUM Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentiallEPSS 0.5%CVE-2020-16121LOWPackageKit error messages leak presence and mimetype of files to unprivileged usersEPSS 0.5%CVE-2026-82727LOWAshPhoenix Form.Auto leaks submitted params in an unknown _union_type error messageEPSS 0.5%CVE-2026-75760HIGHAshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing errorEPSS 0.5%CVE-2026-82580MEDIUMAshAi echoes raw tool exception messages into the conversation, disclosing internal detailsEPSS 0.5%CVE-2025-23216MEDIUMArgo CD does not scrub secret values from patch errorsEPSS 0.5%CVE-2023-4457MEDIUMGrafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.EPSS 0.5%CVE-2026-47893HIGHSpring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketServiceEPSS 0.5%CVE-2024-5435MEDIUMGeneration of Error Message Containing Sensitive Information in GitLabEPSS 0.5%CVE-2026-47622MEDIUMNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive inforEPSS 0.5%CVE-2023-47728MEDIUMIBM QRadar Suite Software information disclosureEPSS 0.5%