Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-108316MEDIUMTanium addressed an information disclosure vulnerability in Tanium Server.EPSS 0.3%CVE-2026-112244MEDIUMDuplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry PointsEPSS 0.3%CVE-2025-12365MEDIUMError Messages Wrapped In HTTP HeaderEPSS 0.3%CVE-2026-54561MEDIUMMCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePathEPSS 0.2%CVE-2026-118272MEDIUMa2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposureEPSS 0.2%CVE-2026-1262MEDIUMIBM InfoSphere Information Server Information DisclosureEPSS 0.2%CVE-2022-22162HIGHJunos OS: A low privileged user can elevate their privileges to the ones of the highest privileged j-web user logged inEPSS 0.2%CVE-2025-66594MEDIUMA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed on the error page. EPSS 0.2%CVE-2026-9583MEDIUMSourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposureEPSS 0.2%CVE-2025-62840HIGHHBS 3 Hybrid Backup SyncEPSS 0.2%CVE-2026-44002MEDIUMvm2: Host File Path Disclosure via Stack Trace Information LeakEPSS 0.2%CVE-2026-67171MEDIUMHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-31960MEDIUMHCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting moduleEPSS 0.2%CVE-2026-67106MEDIUMHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2026-106123MEDIUMRabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()EPSS 0.2%CVE-2023-50355LOWHCL Sametime is impacted by generation of error messages containing sensitive informationEPSS 0.2%CVE-2025-54562MEDIUMA vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical InformatioEPSS 0.2%CVE-2025-43777MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.QEPSS 0.2%CVE-2025-59016MEDIUMInformation Disclosure via File Abstraction LayerEPSS 0.2%CVE-2026-86607MEDIUMInternal Application Information Exposure Vulnerability in Hitachi Ops Center AdministratorEPSS 0.2%