Falhas do tipo CWE-312

502 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2026-76405MEDIUMInformation Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) appEPSS 0.2%CVE-2024-38877HIGHA vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All verEPSS 0.2%CVE-2022-24120MEDIUMCertain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.EPSS 0.2%CVE-2021-3551—A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fiEPSS 0.2%CVE-2026-3277MEDIUMThe OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext iEPSS 0.2%CVE-2024-25658MEDIUMCleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the daEPSS 0.2%CVE-2026-77975HIGHEbyte NA111-M Cleartext Storage of Sensitive InformationEPSS 0.2%CVE-2025-67637MEDIUMJenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins contEPSS 0.2%CVE-2025-32752MEDIUMDell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacker with physical acceEPSS 0.2%CVE-2021-27487—ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker toEPSS 0.2%CVE-2026-3221MEDIUMSensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker wEPSS 0.2%CVE-2020-29501MEDIUMDell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A EPSS 0.2%CVE-2023-49113HIGHSensitive Data Stored Insecurely in Kiuwan SAST Local AnalyzerEPSS 0.2%CVE-2021-38422HIGHDelta Electronics DIALinkEPSS 0.2%CVE-2025-46634HIGHCleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated aEPSS 0.2%CVE-2025-50777HIGHThe firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerabEPSS 0.2%CVE-2024-28809HIGHAn issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers tEPSS 0.2%CVE-2025-2181MEDIUMCheckov by Prisma Cloud: Cleartext Exposure of CredentialsEPSS 0.2%CVE-2026-5224MEDIUMSensitive Data Exposure in Kriptek Crypto's CryptosimEPSS 0.2%CVE-2022-28214—During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are beinEPSS 0.2%