Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-67383MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2022-0622MEDIUMGeneration of Error Message Containing Sensitive Information in snipe/snipe-itEPSS 1.0%CVE-2024-27315MEDIUMApache Superset: Improper error handling on alertsEPSS 1.0%CVE-2019-11252MEDIUMCredential leakage when failing to mountEPSS 1.0%CVE-2021-4177MEDIUMGeneration of Error Message Containing Sensitive Information in livehelperchat/livehelperchatEPSS 1.0%CVE-2023-37260HIGHleague/oauth2-server key exposed in exception message when passing as string and providing invalid pass phraseEPSS 1.0%CVE-2021-35251MEDIUMSensitive Data Disclosure VulnerabilityEPSS 0.9%CVE-2023-40171CRITICALDispatch writes JWT tokens in error messageEPSS 0.9%CVE-2022-0083HIGHGeneration of Error Message Containing Sensitive Information in livehelperchat/livehelperchatEPSS 0.9%CVE-2026-66306MEDIUMSkype for Business Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-34882CRITICALInformation Exposure Vulnerability in RAID Manager Storage Replication AdapterEPSS 0.9%CVE-2017-0885—Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in EPSS 0.9%CVE-2026-69552MEDIUMWindows Print Spooler Components Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-65995MEDIUMApache Airflow: Disclosure of secrets to UI via kwargsEPSS 0.9%CVE-2018-10624MEDIUMJohnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive InformationEPSS 0.9%CVE-2024-21619MEDIUMJunos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive informationEPSS 0.9%CVE-2015-10012LOWsumocoders FrameworkUserBundle login.html.twig information exposureEPSS 0.9%CVE-2023-22626HIGHPgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on databaEPSS 0.9%CVE-2024-53948MEDIUMApache Superset: Error verbosity exposes metadata in analytics databasesEPSS 0.9%CVE-2023-49080LOWJupyter Server errors include tracebacks with path informationEPSS 0.8%