Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-42552HIGHFlight: Sensitive information disclosure via default error handler in flightphp/coreEPSS 0.3%CVE-2023-38716MEDIUMIBM Cloud Pak System information disclosureEPSS 0.3%CVE-2026-33192HIGHfree5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions requesEPSS 0.3%CVE-2026-56568LOWHCL iControl is affected by multiple security vulnerabilities.EPSS 0.3%CVE-2026-113705MEDIUMa2aproject a2a-rs error.rs information exposureEPSS 0.3%CVE-2026-110889HIGHWordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2026-41644HIGHmonetr is vulnerable to server-side request forgery in Lunch Flow link creation and refreshEPSS 0.3%CVE-2024-23575MEDIUMHCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processingEPSS 0.3%CVE-2023-38714MEDIUMIBM Cloud Pak System information disclosureEPSS 0.3%CVE-2023-38713MEDIUMIBM Cloud Pak System information disclosureEPSS 0.3%CVE-2024-30141MEDIUMHCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive informationEPSS 0.3%CVE-2026-105707MEDIUMuptrace user_handler.go Login information exposureEPSS 0.3%CVE-2025-26333MEDIUMDell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacEPSS 0.3%CVE-2026-105828MEDIUMParse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL ErrorsEPSS 0.3%CVE-2023-50953MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.3%CVE-2026-63748MEDIUMSurrealDB before 3.1.0 Information Disclosure via Error MessagesEPSS 0.3%CVE-2025-1395HIGHSensitive Data Exposure in CoDeriApp's HeyGarsonEPSS 0.3%CVE-2026-59271MEDIUMAdmin password disclosed in BrokerNotAliveException messageEPSS 0.3%CVE-2023-38010MEDIUMMultiple Vulnerabilities in IBM Cloud Pak SystemEPSS 0.3%CVE-2026-42459HIGHfree5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udmEPSS 0.3%