Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2023-33835MEDIUMIBM Security Verify Information Queue information disclosureEPSS 0.7%CVE-2018-17891—Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream seEPSS 0.7%CVE-2022-31189MEDIUM"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitizationEPSS 0.7%CVE-2021-31341—Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server anEPSS 0.7%CVE-2023-0655MEDIUMSonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes EPSS 0.7%CVE-2022-38107MEDIUMSensitive Data Disclosure VulnerabilityEPSS 0.7%CVE-2023-42013MEDIUMIBM UrbanCode Deploy information disclosureEPSS 0.7%CVE-2023-43021MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.7%CVE-2020-4868MEDIUMIBM TRIRIGA information disclosureEPSS 0.7%CVE-2020-15219MEDIUMSQL query displayed on portal errorEPSS 0.7%CVE-2022-43891LOWIBM Security Verify Privilege information disclosureEPSS 0.7%CVE-2026-83786MEDIUMWindows NTFS Information Disclosure VulnerabilityEPSS 0.7%CVE-2023-33834MEDIUMIBM Security Verify Information Queue information disclosureEPSS 0.7%CVE-2023-34110LOWFlask-AppBuilder vulnerable to possible disclosure of sensitive information on user errorEPSS 0.7%CVE-2024-23689HIGHClickHouse Client Certificate Password ExposureEPSS 0.7%CVE-2025-55676MEDIUMWindows USB Video Class System Driver Information Disclosure VulnerabilityEPSS 0.7%CVE-2025-53803MEDIUMWindows Kernel Memory Information Disclosure VulnerabilityEPSS 0.7%CVE-2025-22218HIGHVMware Aria Operations for Logs information disclosure vulnerabilityEPSS 0.7%CVE-2023-49878MEDIUMIBM System Storage Virtualization Engine information disclosureEPSS 0.7%CVE-2025-9005MEDIUMmtons mblog register information exposureEPSS 0.7%