Falhas do tipo CWE-212

88 resultados

Divulgação não intencional de informações sensíveis

A aplicação expõe dados confidenciais (senhas, tokens, chaves, dados pessoais) através de canais ou contextos onde não deveriam estar acessíveis. O risco está em um invasor conseguir essas informações sem autenticação ou autorização adequadas, comprometendo a confidencialidade do sistema.

Exemplo

Uma API retorna a senha hash do usuário em resposta de erro, ou logs de produção contêm tokens de API visíveis em páginas de diagnóstico não protegidas, ou cookies de sessão aparecem em URLs refletidas em mensagens de erro.

Como mitigar

Implemente sanitização rigorosa de saídas (erros, logs, respostas HTTP), nunca exponha dados sensíveis em mensagens de erro ou debug, restrinja acesso a ferramentas diagnósticas com autenticação forte e revise regularmente logs e responses da API para dados confidenciais.

CVE-2020-15094HIGHRCE in SymfonyEPSS 3.0%CVE-2022-0355HIGHImproper Removal of Sensitive Information Before Storage or Transfer in feross/simple-getEPSS 2.0%CVE-2022-1650HIGHImproper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsourceEPSS 1.9%CVE-2018-6337HIGHfolly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked childEPSS 1.8%CVE-2022-2818CRITICALImproper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpitEPSS 1.7%CVE-2022-30617—An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, foEPSS 1.5%CVE-2022-24798HIGHInsufficient password hash filtering in some IRRd queries and exportsEPSS 1.4%CVE-2020-14370—An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or thEPSS 1.4%CVE-2018-1062—A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disksEPSS 1.4%CVE-2012-5625MEDIUMOpenstack nova: information leak in libvirt lvm-backed instancesEPSS 1.4%CVE-2022-0536LOWImproper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirectsEPSS 1.3%CVE-2020-14301—An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were EPSS 1.2%CVE-2017-15113HIGHovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can EPSS 1.1%CVE-2022-30618—An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, foEPSS 1.0%CVE-2022-1893MEDIUMImproper Removal of Sensitive Information Before Storage or Transfer in polonel/trudeskEPSS 0.8%CVE-2022-4734HIGHImproper Removal of Sensitive Information Before Storage or Transfer in usememos/memosEPSS 0.8%CVE-2023-28834LOWFull path of data directory exposed to Nextcloud server usersEPSS 0.8%CVE-2026-62900MEDIUM.NET Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-42880CRITICALArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionEPSS 0.6%CVE-2024-43554MEDIUMWindows Kernel-Mode Driver Information Disclosure VulnerabilityEPSS 0.6%