Falhas do tipo CWE-312

502 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2026-57287MEDIUMJenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying hiEPSS 0.2%CVE-2025-70050MEDIUMAn issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackersEPSS 0.2%CVE-2026-55985MEDIUMTycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive InformationEPSS 0.2%CVE-2026-100862MEDIUMheym before 0.0.91 Multiple Secrets Plaintext StorageEPSS 0.2%CVE-2026-7163MEDIUMAssisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosureEPSS 0.2%CVE-2025-5154MEDIUMPhonePe App SQLite Database databases cleartext storage in fileEPSS 0.2%CVE-2026-68933HIGHChartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password StorageEPSS 0.2%CVE-2024-39846LOWNewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitiEPSS 0.2%CVE-2022-35120HIGHIXPdata EasyInstall 6.6.14725 contains an access control issue.EPSS 0.2%CVE-2025-56565HIGHDD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within noEPSS 0.2%CVE-2026-67221MEDIUMRabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwordsEPSS 0.2%CVE-2026-76405MEDIUMInformation Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) appEPSS 0.2%CVE-2026-76377MEDIUMInformation Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAREPSS 0.2%CVE-2026-76384MEDIUMInformation Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAREPSS 0.2%CVE-2026-76381MEDIUMInformation Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAREPSS 0.2%CVE-2026-76380MEDIUMInformation Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAREPSS 0.2%CVE-2026-76386MEDIUMInformation Disclosure through Action Parameters in Zoom app for Splunk SOAREPSS 0.2%CVE-2026-76379MEDIUMInformation Disclosure through Action Parameters in Cisco Webex app for Splunk SOAREPSS 0.2%CVE-2026-76378MEDIUMInformation Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAREPSS 0.2%CVE-2026-76382MEDIUMInformation Disclosure through Action Parameters in Phantom app for Splunk SOAREPSS 0.2%