Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2026-56139MEDIUMApache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clientsEPSS 0.6%CVE-2026-49365MEDIUMApache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clientsEPSS 0.6%CVE-2024-12380MEDIUMGeneration of Error Message Containing Sensitive Information in GitLabEPSS 0.6%CVE-2025-44203HIGHIn HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs EPSS 0.6%CVE-2026-28786MEDIUMOpen WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`EPSS 0.6%CVE-2023-48393MEDIUMKaifa Technology WebITR - Error Message LeakageEPSS 0.6%CVE-2023-6944MEDIUMRhdh: catalog-import function leaks credentials to frontendEPSS 0.6%CVE-2026-66008MEDIUMParse Server 9.0.0 Information Disclosure via GraphQL Error MessagesEPSS 0.6%CVE-2025-8548MEDIUMatjiu pybbs Registered Email SettingsApiController.java sendEmailCode information exposureEPSS 0.6%CVE-2024-6980CRITICALVerbose error handling issue in GravityZone Update Server proxy serviceEPSS 0.6%CVE-2023-3362MEDIUMGeneration of Error Message Containing Sensitive Information in GitLabEPSS 0.5%CVE-2026-77950MEDIUMRPC error handler fails open in AshTypescript, disclosing unredacted errorsEPSS 0.5%CVE-2026-82733MEDIUMRoute handler return value echoed into AshTypescript error responseEPSS 0.5%CVE-2022-2760MEDIUMIn affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erroEPSS 0.5%CVE-2024-45817HIGHx86: Deadlock in vlapic_error()EPSS 0.5%CVE-2023-33181MEDIUMSensitive Information Disclosure abusing Stack Trace in Xibo CMSEPSS 0.5%CVE-2024-35156MEDIUMIBM MQ information disclosureEPSS 0.5%CVE-2025-20150MEDIUMCisco Nexus Dashboard Username Enumeration VulnerabilityEPSS 0.5%CVE-2024-13535MEDIUMActionwear products sync <= 2.3.2 - Unauthenticated Full Patch DisclosureEPSS 0.5%CVE-2023-27860MEDIUMIBM Maximo Asset Management information disclosureEPSS 0.5%