Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-52394CRITICALDeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.EPSS 0.4%CVE-2024-13536MEDIUM1003 Mortgage Application <= 1.87 - Unauthenticated Full Path DisclosureEPSS 0.4%CVE-2023-27319MEDIUM CVE-2023-27319 Information Disclosure Vulnerability in ONTAP MediatorEPSS 0.4%CVE-2022-39304MEDIUMghinstallation returns app JWT in error responsesEPSS 0.4%CVE-2021-3620—A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is discloseEPSS 0.4%CVE-2023-47639MEDIUMAPI Platform Core can leak exceptions message that may contain sensitive informationEPSS 0.4%CVE-2025-54291MEDIUMProject existence disclosure in LXD images APIEPSS 0.4%CVE-2024-28765MEDIUMSecurity vulnerability was found in IBM Security Directory IntegratorEPSS 0.4%CVE-2025-52671MEDIUMDebug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to aEPSS 0.4%CVE-2024-39725MEDIUMIBM Engineering Lifecycle Optimization - Engineering Insights information disclosureEPSS 0.4%CVE-2024-35134MEDIUMIBM Analytics Content Hub information disclosureEPSS 0.4%CVE-2026-55375MEDIUMcanto-saas-api: OAuth credentials exposed in URL query string and exception messagesEPSS 0.4%CVE-2025-46575MEDIUMZTE GoldenDB Database product has an information disclosure vulnerabilityEPSS 0.4%CVE-2024-41674MEDIUMCKAN may leak Solr credentials via error message in package_search actionEPSS 0.4%CVE-2026-84499HIGHAutomation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error messageEPSS 0.4%CVE-2024-6984HIGHAn issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access EPSS 0.4%CVE-2024-11129MEDIUMGeneration of Error Message Containing Sensitive Information in GitLabEPSS 0.4%CVE-2024-45713MEDIUMSolarWinds Kiwi CatTools Sensitive Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-48896MEDIUMMoodle: users' names returned in messaging error messageEPSS 0.4%CVE-2026-17215MEDIUMMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%