Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2025-32238MEDIUMWordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2025-24552MEDIUMWordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerabilityEPSS 0.5%CVE-2023-6839MEDIUMDue to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in thEPSS 0.5%CVE-2023-37489MEDIUMInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)EPSS 0.5%CVE-2026-78693MEDIUMIncomplete redaction re-attaches the original error path in AshGraphql, leaking internal field namesEPSS 0.5%CVE-2024-31844MEDIUMAn issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disEPSS 0.5%CVE-2026-53906MEDIUMPath Disclosure and Path Traversal in MCOEPSS 0.5%CVE-2025-11065MEDIUMGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructureEPSS 0.5%CVE-2022-32756LOWIBM Security Verify Directory information disclosureEPSS 0.5%CVE-2026-40245HIGHFree5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authenticationEPSS 0.5%CVE-2024-28285CRITICALA Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reEPSS 0.5%CVE-2024-35232LOWgithub.com/huandu/facebook may expose access_token in error messageEPSS 0.5%CVE-2026-112947MEDIUMVite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`EPSS 0.5%CVE-2026-13182HIGHRadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.5%CVE-2026-43630MEDIUMllama.cpp b4882-b8487 Out-of-Bounds Read Information DisclosureEPSS 0.5%CVE-2026-1175MEDIUMbirkir prime GraphQL Directive graphql information exposureEPSS 0.5%CVE-2026-45723LOWOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematicEPSS 0.5%CVE-2024-54141HIGHphpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not availableEPSS 0.5%CVE-2026-77076HIGHn8n before 1.123.69 Credential Leak via GraphQL Node ErrorEPSS 0.5%CVE-2021-20455LOWIBM Cognos Controller information disclosureEPSS 0.5%