Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2021-1546MEDIUMCisco SD-WAN Software Information Disclosure VulnerabilityEPSS 0.2%CVE-2025-59177MEDIUMGeneration of Error Message Containing Sensitive Information VulnerabilityEPSS 0.2%CVE-2021-47161MEDIUMspi: spi-fsl-dspi: Fix a resource leak in an error handling pathEPSS 0.2%CVE-2026-3259HIGHSensitive Data Disclosure in BigQuery via Materialized View Error MessagesEPSS 0.2%CVE-2026-22052MEDIUMONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could alEPSS 0.2%CVE-2026-47775MEDIUMEnvoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie DecryptionEPSS 0.2%CVE-2026-1248MEDIUMIBM Business Automation Workflow information leakEPSS 0.2%CVE-2023-31429MEDIUMMultiple commands print sensitive information in the terminalEPSS 0.2%CVE-2026-5511MEDIUMInformation Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72EPSS 0.2%CVE-2026-105702MEDIUMMultiple vulnerabilities that affects IBM Db2 Genius HubEPSS 0.2%CVE-2025-43776MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 202EPSS 0.2%CVE-2025-36437MEDIUMIBM Planning Analytics Local is vulnerable to disclosing sensitive informationEPSS 0.2%CVE-2024-41983MEDIUMA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.2%CVE-2023-34339LOWIn JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's messageEPSS 0.2%CVE-2026-67172LOWHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2024-3454LOWIn-Fabric Matter Cluster Attribute DisclosureEPSS 0.2%CVE-2026-4994MEDIUMwandb OpenUI APIStatusError server.py generic_exception_handler information exposureEPSS 0.2%CVE-2024-52897MEDIUMIBM MQ information disclosureEPSS 0.2%CVE-2026-102904MEDIUMJupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLsEPSS 0.2%CVE-2026-40969LOWSpring gRPC AuthenticationException message reflected to remote clientEPSS 0.2%