Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2025-4166MEDIUMVault May Include Sensitive Data in Error Logs When Using the KV v2 PluginEPSS 0.5%CVE-2026-11873MEDIUMPki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosureEPSS 0.5%CVE-2026-92936MEDIUMvm2 3.11.0 before 3.11.7 Information Disclosure via Error StackEPSS 0.5%CVE-2023-26272MEDIUMIBM Security Guardium Data Encryption information disclosureEPSS 0.5%CVE-2025-59872MEDIUMHCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,EPSS 0.5%CVE-2025-52022MEDIUMA vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed EPSS 0.5%CVE-2025-52023MEDIUMA vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed erroEPSS 0.5%CVE-2023-42475MEDIUMInformation Disclosure Vulnerability in Statutory ReportingEPSS 0.5%CVE-2026-53458MEDIUMBlueprint Studio API exposed internal exception detailsEPSS 0.5%CVE-2023-5514MEDIUM The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumeEPSS 0.4%CVE-2022-4870MEDIUMIn affected versions of Octopus Deploy it is possible to discover network details via error messageEPSS 0.4%CVE-2024-35119MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.4%CVE-2026-66009MEDIUMParse Server 9.0.0 Information Disclosure via GraphQL Error MessagesEPSS 0.4%CVE-2026-74879HIGHopenssl_encrypt before 1.4.0 Information Disclosure via /ready endpointEPSS 0.4%CVE-2024-8571MEDIUMerjemin roll_cms views.py information exposureEPSS 0.4%CVE-2024-39458LOWWhen Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnosticEPSS 0.4%CVE-2023-0833MEDIUMRed hat a-mq streams: component version with information disclosure flawEPSS 0.4%CVE-2026-9794MEDIUMKeycloak: keycloak: information disclosure via saml ecp endpointEPSS 0.4%CVE-2022-4769MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information EPSS 0.4%CVE-2022-4770MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information EPSS 0.4%