Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-41730MEDIUMSpring Data REST exposes persistence-layer internals in error responsesEPSS 0.2%CVE-2025-0941MEDIUMMET ONE 3400+ Potential Credential ExposureEPSS 0.2%CVE-2023-40725MEDIUMA vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages EPSS 0.2%CVE-2024-6613MEDIUMIncorrect listing of stack framesEPSS 0.2%CVE-2023-28514MEDIUMIBM MQ information disclosureEPSS 0.2%CVE-2026-82739LOWAsh.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch errorEPSS 0.2%CVE-2026-101029MEDIUMGitea migration and pull mirror SSRF through multi-answer DNSEPSS 0.2%CVE-2026-78021LOWDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive EPSS 0.2%CVE-2024-41984LOWA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.2%CVE-2022-35640MEDIUMIBM Sterling Partner Engagement Manager information disclosureEPSS 0.2%CVE-2024-52898MEDIUMIBM MQ information disclosureEPSS 0.2%CVE-2025-5731MEDIUMInfinispan: credential leakage in infinispan cliEPSS 0.2%CVE-2026-91163LOWWarpgate: Kubernetes listener discloses internal error text to an unauthenticated callerEPSS 0.2%CVE-2022-34881LOWInformation Exposure Vulnerability in JP1/Automatic OperationEPSS 0.2%CVE-2025-52606MEDIUMHCL iControl was affected by Weak Input Validation vulnerability. .EPSS 0.2%CVE-2025-59853LOWHCL DFXAnalytics is affected by an Improper Error Handling vulnerabilityEPSS 0.2%CVE-2026-24511MEDIUMDell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message contEPSS 0.2%CVE-2025-55250LOWHCL AION is affected by a Technical Error Disclosure vulnerabilityEPSS 0.2%CVE-2026-55102MEDIUMhashi-vault-js: Vault token and secret values exposed in thrown errorsEPSS 0.2%CVE-2026-66248LOWHCL iControl is affected by an Improper Error Handling vulnerabilityEPSS 0.2%