Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2025-52611LOWHCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerabilityEPSS 0.2%CVE-2026-123036MEDIUMA flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exceptEPSS 0.2%CVE-2024-56812LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56467LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56811LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56810LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56494LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56496LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56493LOWIBM EntireX information disclosureEPSS 0.1%CVE-2024-56495LOWIBM EntireX information disclosureEPSS 0.1%CVE-2026-29110LOWCryptomator: Leaking of cleartext paths into log file in non-debug modeEPSS 0.1%CVE-2025-40760MEDIUMA vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messageEPSS 0.1%CVE-2026-21809LOWHCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive informationEPSS 0.1%CVE-2022-20525LOWIn enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissioEPSS 0.1%CVE-2026-88467MEDIUMCRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors EPSS 0.1%CVE-2026-27004MEDIUMOpenClaw session tool visibility hardening and Telegram webhook secret fallbackEPSS 0.1%CVE-2026-7860LOWPossible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend BuildEPSS 0.1%CVE-2025-52641LOWInternal Filesystem Exploration vulnerabilityEPSS 0.1%CVE-2026-85115MEDIUMA vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do nEPSS 0.1%CVE-2025-22421MEDIUMIn contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen dueEPSS 0.1%