Falhas do tipo CWE-212

88 resultados

Divulgação não intencional de informações sensíveis

A aplicação expõe dados confidenciais (senhas, tokens, chaves, dados pessoais) através de canais ou contextos onde não deveriam estar acessíveis. O risco está em um invasor conseguir essas informações sem autenticação ou autorização adequadas, comprometendo a confidencialidade do sistema.

Exemplo

Uma API retorna a senha hash do usuário em resposta de erro, ou logs de produção contêm tokens de API visíveis em páginas de diagnóstico não protegidas, ou cookies de sessão aparecem em URLs refletidas em mensagens de erro.

Como mitigar

Implemente sanitização rigorosa de saídas (erros, logs, respostas HTTP), nunca exponha dados sensíveis em mensagens de erro ou debug, restrinja acesso a ferramentas diagnósticas com autenticação forte e revise regularmente logs e responses da API para dados confidenciais.

CVE-2026-107291LOWPydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`EPSS 0.6%CVE-2018-5559LOWIn Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could returnEPSS 0.6%CVE-2025-61594LOWURI Credential Leakage Bypass over CVE-2025-27221EPSS 0.6%CVE-2024-8474HIGHOpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, EPSS 0.5%CVE-2024-31493MEDIUMAn improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 anEPSS 0.5%CVE-2026-45737MEDIUMArgo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotationsEPSS 0.5%CVE-2025-27221LOWIn the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication crEPSS 0.5%CVE-2024-6055MEDIUMImproper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on WinEPSS 0.5%CVE-2026-40895MEDIUMfollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsEPSS 0.5%CVE-2026-111756HIGHfollow-redirects array-form headers bypass cross-origin credential strippingEPSS 0.5%CVE-2025-68131MEDIUMCBORDecoder reuse can leak shareable values across decode callsEPSS 0.5%CVE-2025-53886MEDIUMDirectus doesn't redact tokens in Flow logsEPSS 0.5%CVE-2026-16104MEDIUMKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminsEPSS 0.5%CVE-2026-20928MEDIUMWindows Recovery Environment Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-85094HIGHThe Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat EPSS 0.4%CVE-2026-82069MEDIUMImproper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster RouterEPSS 0.4%CVE-2025-14267MEDIUMUnintended temporary cached data included in a structure only copy intended to be empty of dataEPSS 0.4%CVE-2025-58049MEDIUMXWiki PDF export jobs store sensitive cookies unencrypted in job statusesEPSS 0.4%CVE-2026-67071MEDIUMHCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or TransferEPSS 0.4%CVE-2026-78658MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerabilityEPSS 0.4%