Falhas do tipo CWE-209

432 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2025-5731MEDIUMInfinispan: credential leakage in infinispan cliEPSS 0.2%CVE-2026-24511MEDIUMDell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message contEPSS 0.2%CVE-2026-56537LOWHCL Connections is vulnerable to information disclosureEPSS 0.2%CVE-2025-55250LOWHCL AION is affected by a Technical Error Disclosure vulnerabilityEPSS 0.2%CVE-2025-52611LOWHCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerabilityEPSS 0.2%CVE-2024-56812LOWIBM EntireX information disclosureEPSS 0.1%CVE-2025-59177MEDIUMGeneration of Error Message Containing Sensitive Information VulnerabilityEPSS 0.1%CVE-2024-56467LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56811LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56494LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56493LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56496LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56810LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56495LOWIBM EntireX information disclosureEPSS 0.1%CVE-2025-40760MEDIUMA vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messageEPSS 0.1%CVE-2026-82739LOWAsh.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch errorEPSS 0.1%CVE-2026-29110LOWCryptomator: Leaking of cleartext paths into log file in non-debug modeEPSS 0.1%CVE-2026-7860LOWPossible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend BuildEPSS 0.1%CVE-2022-20525LOWIn enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissioEPSS 0.1%CVE-2025-52641LOWInternal Filesystem Exploration vulnerabilityEPSS 0.1%