Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2025-23185MEDIUMInformation Disclosure in SAP Business Objects Business Intelligence PlatformEPSS 0.3%CVE-2026-21783MEDIUMHCL Traveler is affected by sensitive information disclosureEPSS 0.3%CVE-2026-56571LOWHCL iControl is affected by multiple security vulnerabilities.EPSS 0.3%CVE-2026-14909MEDIUMIBM WebSphere Application Server Liberty Information DisclosureEPSS 0.3%CVE-2025-9229MEDIUMInformation Disclosure in MiR robots and MiR fleet through verbose error pagesEPSS 0.3%CVE-2025-9122MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive InformationEPSS 0.3%CVE-2025-41076MEDIUMMultiple vulnerabilities in LimesurveyEPSS 0.3%CVE-2025-62397MEDIUMMoodle: router produces json instead of 404 error for invalid course idEPSS 0.3%CVE-2025-54791MEDIUMOMERO.web displays unecessary user information when requesting to reset the passwordEPSS 0.3%CVE-2026-33333LOWCombodo iTop: Information disclosure in ajax.render.phpEPSS 0.3%CVE-2024-52896MEDIUMIBM MQ information disclosureEPSS 0.3%CVE-2026-69247HIGHcryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingEPSS 0.3%CVE-2025-61959MEDIUMVertikal Systems Hospital Manager Backend Services Generation of Error Message Containing Sensitive InformationEPSS 0.3%CVE-2026-71463LOWAutomation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacksEPSS 0.3%CVE-2025-0049LOWDisclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0EPSS 0.3%CVE-2026-56537LOWHCL Connections is vulnerable to information disclosureEPSS 0.3%CVE-2026-3628MEDIUMIBM Concert Software Information DisclosureEPSS 0.3%CVE-2026-41935HIGHVvveb < 1.0.8.3 Uncontrolled Recursion Denial of ServiceEPSS 0.3%CVE-2026-105770MEDIUMOcto STS discloses trust policy contents to unauthorized callers via Exchange error messagesEPSS 0.3%CVE-2026-118643MEDIUMn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error DataEPSS 0.3%