Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-43873HIGHWWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone ServerEPSS 0.3%CVE-2026-41931MEDIUMVvveb < 1.0.8.2 Information Disclosure via Debug Exception HandlerEPSS 0.3%CVE-2025-36090MEDIUMIBM Analytics Content Hub information disclosureEPSS 0.3%CVE-2025-66549LOWNextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directoryEPSS 0.3%CVE-2023-50348LOWImproper Error Handling affects DRYiCE MyXalyticsEPSS 0.3%CVE-2023-38017MEDIUMMultiple Vulnerabilities in IBM Cloud Pak SystemEPSS 0.3%CVE-2023-38281MEDIUMMultiple Vulnerabilities in IBM Cloud Pak SystemEPSS 0.3%CVE-2026-4921LOWIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.3%CVE-2026-116479MEDIUMa2aproject a2a-java JSON-RPC Error getMessage information exposureEPSS 0.3%CVE-2026-116477MEDIUMa2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposureEPSS 0.3%CVE-2026-27643MEDIUMfree5GC has improper error handling in NEF with information exposureEPSS 0.3%CVE-2025-15526MEDIUMFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' ParameterEPSS 0.3%CVE-2025-69208LOWfree5GC UDR's NEF incorrectly returns 500 for missing PFD data (UDR 404) in Nnef_PfdManagement GET requestEPSS 0.3%CVE-2025-20002MEDIUMGMOD Apollo Generation of Error Message Containing Sensitive InformationEPSS 0.3%CVE-2022-50686MEDIUMKentico Xperience <= 12.0 Portal Engine Form Control Information DisclosureEPSS 0.3%CVE-2025-0279MEDIUMHCL Traveler is affected by generation of error messages containing sensitive informationEPSS 0.3%CVE-2026-2752MEDIUMNavtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to EPSS 0.3%CVE-2026-114348MEDIUMwebpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpointEPSS 0.3%CVE-2024-5250LOWOverly Verbose Errors in SAML IntegrationEPSS 0.3%CVE-2026-4638HIGHPlaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network MonitorEPSS 0.3%