Falhas do tipo CWE-212

88 resultados

Divulgação não intencional de informações sensíveis

A aplicação expõe dados confidenciais (senhas, tokens, chaves, dados pessoais) através de canais ou contextos onde não deveriam estar acessíveis. O risco está em um invasor conseguir essas informações sem autenticação ou autorização adequadas, comprometendo a confidencialidade do sistema.

Exemplo

Uma API retorna a senha hash do usuário em resposta de erro, ou logs de produção contêm tokens de API visíveis em páginas de diagnóstico não protegidas, ou cookies de sessão aparecem em URLs refletidas em mensagens de erro.

Como mitigar

Implemente sanitização rigorosa de saídas (erros, logs, respostas HTTP), nunca exponha dados sensíveis em mensagens de erro ou debug, restrinja acesso a ferramentas diagnósticas com autenticação forte e revise regularmente logs e responses da API para dados confidenciais.

CVE-2024-41156LOWProfile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers vaEPSS 0.4%CVE-2024-43384HIGHPhoenix Contact: Improper removal of sensitive information in MGUARD productsEPSS 0.3%CVE-2026-27640HIGHtfplan2md has Sensitive Value Exposure in Generated ReportsEPSS 0.3%CVE-2023-52376HIGHInformation management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.3%CVE-2026-43528HIGHOpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig AliasesEPSS 0.3%CVE-2025-48708MEDIUMgs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A createEPSS 0.3%CVE-2020-25635MEDIUMA flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is compleEPSS 0.3%CVE-2025-57757MEDIUMContao discloses information in the news moduleEPSS 0.3%CVE-2024-56353MEDIUMIn JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookiesEPSS 0.3%CVE-2022-23605MEDIUMExpired Ephemeral Messages not reliably removed in wire-webappEPSS 0.3%CVE-2026-90860HIGHThe Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVieEPSS 0.3%CVE-2025-59955MEDIUMCoolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpointEPSS 0.3%CVE-2026-107293LOWPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`EPSS 0.3%CVE-2026-1732MEDIUMImproper Removal of Sensitive Information Before Storage or Transfer in GitLabEPSS 0.3%CVE-2024-32028MEDIUMSensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreEPSS 0.3%CVE-2026-86740MEDIUMSnipe-IT before 8.7.0 Attachment Deletion Reports Success While File RemainsEPSS 0.3%CVE-2026-54421MEDIUMIn OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can returnEPSS 0.3%CVE-2025-62483MEDIUMZoom Clients - Improper Removal of Sensitive InformationEPSS 0.3%CVE-2024-29120MEDIUMApache StreamPark: Information leakage vulnerabilityEPSS 0.3%CVE-2026-39937HIGHGlobal vanishing does not completely remove user emailEPSS 0.3%