Falhas do tipo CWE-312

502 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2026-39943MEDIUMDirectus exposes sensitive fields in revision historyEPSS 0.2%CVE-2026-34833HIGHBulwark Webmail: Information Exposure: password returned in /api/auth/sessionEPSS 0.2%CVE-2022-45154MEDIUMsupportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.shEPSS 0.2%CVE-2023-40715MEDIUMA cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access toEPSS 0.2%CVE-2026-63207MEDIUMZammad: Sensitive Information Exposure in Integration Administration APIEPSS 0.2%CVE-2023-37468MEDIUMStoring unencrypted LDAP passwords in feedbacksystemEPSS 0.2%CVE-2026-6553HIGHTYPO3 CMS Stores Cleartext Password in User Settings ModuleEPSS 0.2%CVE-2026-21080MEDIUMCleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.EPSS 0.2%CVE-2026-67236HIGHRabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /loginEPSS 0.2%CVE-2018-16498—In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These EPSS 0.2%CVE-2024-45718MEDIUMSensitive data disclosure vulnerabilityEPSS 0.2%CVE-2024-56428MEDIUMThe local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for thEPSS 0.2%CVE-2026-73748LOWAuthenticated Sensitive Information Disclosure in HPE Networking Fabric ComposerEPSS 0.2%CVE-2024-53651MEDIUMA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CEPSS 0.2%CVE-2026-102539MEDIUMSuper Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is setEPSS 0.2%CVE-2024-54127MEDIUMExposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50EPSS 0.2%CVE-2025-47820LOWFlock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.EPSS 0.2%CVE-2025-67638MEDIUMJenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasEPSS 0.2%CVE-2025-12679HIGHPlain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0EPSS 0.2%CVE-2025-6224MEDIUMKey leakage in juju/utils certificatesEPSS 0.2%