Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2023-47636MEDIUMFull Path Disclosure via re-export document in pimcore/admin-ui-classic-bundleEPSS 0.7%CVE-2026-20838MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-84180MEDIUMApache Camel: Camel-Knative Information Disclosure via Unmuted Consumer ExceptionsEPSS 0.6%CVE-2023-28117HIGHSentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`EPSS 0.6%CVE-2024-53253MEDIUMSentry's improper error handling leaks Application Integration Client SecretEPSS 0.6%CVE-2023-32755MEDIUMe-Excellence U-Office Force - Error Message LeakageEPSS 0.6%CVE-2022-33930MEDIUMDell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit thiEPSS 0.6%CVE-2026-85246MEDIUMApache Camel: Camel-Mina Information Disclosure via Unmuted Consumer ExceptionsEPSS 0.6%CVE-2026-85257MEDIUMApache Camel: Camel-CXF Information Disclosure via Unmuted Consumer ExceptionsEPSS 0.6%CVE-2023-35124LOWAn information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS PlatEPSS 0.6%CVE-2022-2508MEDIUMIn affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to EPSS 0.6%CVE-2024-13538MEDIUMBigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path DisclosuteEPSS 0.6%CVE-2024-2009MEDIUMNway Pro Argument index.php ajax_login_submit_form information exposureEPSS 0.6%CVE-2022-40292MEDIUMUnauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.6%CVE-2024-35155MEDIUMIBM MQ information disclosureEPSS 0.6%CVE-2023-1210LOWGeneration of Error Message Containing Sensitive Information in GitLabEPSS 0.6%CVE-2024-22646MEDIUMAn email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to gueEPSS 0.6%CVE-2024-54366MEDIUMWordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerabilityEPSS 0.6%CVE-2023-47152MEDIUMIBM Db2 information disclosureEPSS 0.6%CVE-2024-25037MEDIUMIBM Cognos Controller information disclosureEPSS 0.6%