Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2021-3986MEDIUMInformation Disclosure in janeczku/calibre-webEPSS 0.4%CVE-2025-31141LOWIn JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles pageEPSS 0.4%CVE-2026-30835MEDIUMParse Server: Malformed `$regex` query leaks database error details in API responseEPSS 0.4%CVE-2025-2239MEDIUMAbsolute Path Disclosure Vulnerability in Hillstone Next Generation FireWallEPSS 0.4%CVE-2026-49979MEDIUMAppsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP FilterEPSS 0.4%CVE-2025-25025MEDIUMIBM Security Guardium information disclosureEPSS 0.4%CVE-2025-36328MEDIUMError Message Containing Sensitive Information found in Watson Data IntelligenceEPSS 0.4%CVE-2024-35111MEDIUMIBM Control Center information disclosureEPSS 0.4%CVE-2026-40997MEDIUMSOAP security faults leak Spring Security account stateEPSS 0.4%CVE-2025-12773HIGHPlain password is generated in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0aEPSS 0.4%CVE-2024-45659MEDIUMIBM Security Verify Access information disclosureEPSS 0.4%CVE-2024-43376MEDIUMUmbraco CMS vulnerable to Generation of Error Message Containing Sensitive InformationEPSS 0.4%CVE-2024-5591MEDIUMIBM Jazz Foundation information disclosureEPSS 0.4%CVE-2026-71461MEDIUMAutomation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handlerEPSS 0.4%CVE-2024-55895LOWIBM InfoSphere Information Server information disclosureEPSS 0.4%CVE-2024-39737MEDIUMIBM Datacap Navigator information disclosureEPSS 0.4%CVE-2026-73844LOWCKAN MCP Server: Information disclosure via verbose error reflectionEPSS 0.4%CVE-2026-62979HIGHjack: upstream error responses expose backend and peer credentialsEPSS 0.4%CVE-2024-52611LOWSolarWinds Platform Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-51560HIGHImproper Error Handling Vulnerability in Wave 2.0EPSS 0.4%