Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-114348MEDIUMwebpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpointEPSS 0.3%CVE-2026-45728HIGHAlgernon: Single-file mode unconditionally enables debug modeEPSS 0.3%CVE-2026-24130LOWMoonraker with LDAP Enabled Allows Malicious Search Filter InjectionEPSS 0.3%CVE-2025-13978MEDIUMGeneration of Error Message Containing Sensitive Information in GitLabEPSS 0.3%CVE-2025-46746MEDIUMError Message Contains Sensitive InformationEPSS 0.3%CVE-2024-51460MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.3%CVE-2024-11625HIGHInformation Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from EPSS 0.3%CVE-2025-52619MEDIUMHCL BigFix SaaS Authentication Service is affected by a sensitive information disclosureEPSS 0.3%CVE-2026-79777MEDIUMrclone before v1.75.0 Information Disclosure via RC APIEPSS 0.3%CVE-2023-40457—The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause aEPSS 0.3%CVE-2020-2505LOWSensitive information via generation of error messages vulnerability in QESEPSS 0.3%CVE-2026-75597MEDIUMpyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typoEPSS 0.3%CVE-2026-56620MEDIUMHCL BigFix Mobile is vulnerable to information disclosureEPSS 0.3%CVE-2026-2484MEDIUMIBM InfoSphere Information Server Information DisclosureEPSS 0.3%CVE-2026-1030MEDIUMMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentEPSS 0.3%CVE-2026-33065MEDIUMfree5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions requestEPSS 0.3%CVE-2026-28675MEDIUMOpenSift: Sensitive implementation details exposed via raw exception messages and token-returning endpointsEPSS 0.3%CVE-2025-14243MEDIUMMirror-registry: openshift mirror registry: user enumeration via authentication error messagesEPSS 0.3%CVE-2024-37162MEDIUMzsa Generates Error Messages Containing Sensitive InformationEPSS 0.3%CVE-2026-47248MEDIUMParse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersEPSS 0.3%