Falhas do tipo CWE-209

429 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2024-37524MEDIUMIBM Analytics Content Hub information disclosureEPSS 0.3%CVE-2025-14243MEDIUMMirror-registry: openshift mirror registry: user enumeration via authentication error messagesEPSS 0.3%CVE-2026-77076HIGHn8n before 1.123.69 Credential Leak via GraphQL Node ErrorEPSS 0.3%CVE-2025-23185MEDIUMInformation Disclosure in SAP Business Objects Business Intelligence PlatformEPSS 0.3%CVE-2025-9229MEDIUMInformation Disclosure in MiR robots and MiR fleet through verbose error pagesEPSS 0.3%CVE-2025-9122MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive InformationEPSS 0.3%CVE-2026-2484MEDIUMIBM InfoSphere Information Server Information DisclosureEPSS 0.3%CVE-2026-75760HIGHAshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing errorEPSS 0.3%CVE-2026-33065MEDIUMfree5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions requestEPSS 0.3%CVE-2025-69208LOWfree5GC UDR's NEF incorrectly returns 500 for missing PFD data (UDR 404) in Nnef_PfdManagement GET requestEPSS 0.3%CVE-2026-21783MEDIUMHCL Traveler is affected by sensitive information disclosureEPSS 0.3%CVE-2026-27643MEDIUMfree5GC has improper error handling in NEF with information exposureEPSS 0.3%CVE-2024-52896MEDIUMIBM MQ information disclosureEPSS 0.3%CVE-2025-52619MEDIUMHCL BigFix SaaS Authentication Service is affected by a sensitive information disclosureEPSS 0.3%CVE-2025-36090MEDIUMIBM Analytics Content Hub information disclosureEPSS 0.3%CVE-2026-82580MEDIUMAshAi echoes raw tool exception messages into the conversation, disclosing internal detailsEPSS 0.3%CVE-2026-82727LOWAshPhoenix Form.Auto leaks submitted params in an unknown _union_type error messageEPSS 0.3%CVE-2026-41935HIGHVvveb < 1.0.8.3 Uncontrolled Recursion Denial of ServiceEPSS 0.3%CVE-2026-47622MEDIUMNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive inforEPSS 0.3%CVE-2026-66009MEDIUMParse Server 9.0.0 Information Disclosure via GraphQL Error MessagesEPSS 0.3%