Falhas do tipo CWE-312

501 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2024-33471HIGHAn issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafteEPSS 0.3%CVE-2024-29956MEDIUMcleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnavEPSS 0.3%CVE-2023-48707MEDIUMCleartext Storage of Sensitive Information in codeigniter4/shieldEPSS 0.3%CVE-2025-7426CRITICALMINOVA TTA Information Disclosure and Credential ExposureEPSS 0.3%CVE-2019-3937—Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuratEPSS 0.3%CVE-2026-114551MEDIUMMailEnable Auth Cleartext Storage Information Disclosure VulnerabilityEPSS 0.3%CVE-2022-45787MEDIUMApache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProviderEPSS 0.3%CVE-2024-42451HIGHA vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by caEPSS 0.3%CVE-2024-23584MEDIUMHCL BigFix Asset Discovery is affected by a security vulnerabilityEPSS 0.3%CVE-2025-2120LOWThinkware Car Dashcam F800 Pro Configuration File hostapd.conf cleartext storage in a file or on diskEPSS 0.3%CVE-2026-62376HIGHVikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessEPSS 0.3%CVE-2025-10464MEDIUMCleartext password storage in Birtech Information Technologies' SensawayEPSS 0.3%CVE-2025-44649HIGHIn the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive modEPSS 0.3%CVE-2025-0142MEDIUMZoom Jenkins Marketplace plugin - Cleartext Storage of Sensitive InformationEPSS 0.3%CVE-2020-14480MEDIUMDue to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to cerEPSS 0.3%CVE-2026-43824HIGHIn Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.EPSS 0.3%CVE-2025-46633HIGHCleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt EPSS 0.3%CVE-2024-46383LOWHathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintextEPSS 0.3%CVE-2025-65320HIGHAbacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The applicatEPSS 0.3%CVE-2025-63208HIGHAn issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive EPSS 0.3%