Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-116478MEDIUMa2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposureEPSS 0.4%CVE-2024-45658LOWIBM Security Verify Access information disclosureEPSS 0.4%CVE-2022-0563MEDIUMA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" envirEPSS 0.4%CVE-2023-23474LOWIBM Cognos Controller information disclosureEPSS 0.4%CVE-2026-73101CRITICALApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsEPSS 0.4%CVE-2024-52043MEDIUMUser enumeration in HubHubEPSS 0.4%CVE-2025-40718MEDIUMImproper error handling vulnerability in Quiter GatewayEPSS 0.4%CVE-2026-91882HIGHDell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible FilEPSS 0.4%CVE-2026-59943MEDIUMDompdf: Embedded SVG images can leak existence of files and directories within the filesystemEPSS 0.4%CVE-2021-27774LOWAn injection vulnerability affects HCL Digital ExperienceEPSS 0.4%CVE-2025-68110CRITICALChurchCRM discloses database information on error messageEPSS 0.4%CVE-2026-4633LOWKeycloak: keycloak: user enumeration via differential error messagesEPSS 0.4%CVE-2025-46658CRITICALAn issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.EPSS 0.4%CVE-2026-85709MEDIUMLightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesEPSS 0.4%CVE-2024-39751MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.4%CVE-2024-13540MEDIUMWooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path DsiclosureEPSS 0.4%CVE-2024-13539MEDIUMAForms Eats <= 1.3.1 - Unauthenticated Full Path DisclosureEPSS 0.4%CVE-2025-40653MEDIUMUser enumeration in M3M Printer Server WebEPSS 0.4%CVE-2026-73555MEDIUMvLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error MessagesEPSS 0.4%CVE-2026-105283MEDIUMInternal error terms inspected into AshTypescript RPC error responsesEPSS 0.4%