Falhas do tipo CWE-209

427 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2024-13539MEDIUMAForms Eats <= 1.3.1 - Unauthenticated Full Path DisclosureEPSS 0.4%CVE-2026-92936MEDIUMvm2 3.11.0 before 3.11.7 Information Disclosure via Error StackEPSS 0.4%CVE-2021-27774LOWAn injection vulnerability affects HCL Digital ExperienceEPSS 0.4%CVE-2024-21866MEDIUMGeneration of Error Message Containing Sensitive Information in Rapid SCADAEPSS 0.4%CVE-2021-21416LOWPotential sensitive information disclosed in error reportsEPSS 0.4%CVE-2023-49107MEDIUMGeneration of Error Message Containing Sensitive Information Vulnerability in Hitachi Device ManagerEPSS 0.4%CVE-2024-36106MEDIUMArgo CD allows authenticated users to enumerate clusters by nameEPSS 0.4%CVE-2025-1350MEDIUMMultiple vulnerabilities in IBM ControllerEPSS 0.4%CVE-2026-8861MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2025-40653MEDIUMUser enumeration in M3M Printer Server WebEPSS 0.4%CVE-2025-49128MEDIUMJackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationEPSS 0.4%CVE-2023-27319MEDIUM CVE-2023-27319 Information Disclosure Vulnerability in ONTAP MediatorEPSS 0.4%CVE-2025-31998LOWHCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive informationEPSS 0.4%CVE-2021-3620—A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is discloseEPSS 0.4%CVE-2024-52893MEDIUMIBM Concert Software information disclosureEPSS 0.4%CVE-2023-4457MEDIUMGrafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.EPSS 0.4%CVE-2024-13536MEDIUM1003 Mortgage Application <= 1.87 - Unauthenticated Full Path DisclosureEPSS 0.4%CVE-2025-54291MEDIUMProject existence disclosure in LXD images APIEPSS 0.4%CVE-2026-45723LOWOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematicEPSS 0.4%CVE-2025-41441MEDIUMMailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attackerEPSS 0.4%