Falhas do tipo CWE-312

469 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2026-76381MEDIUMInformation Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAREPSS 0.1%CVE-2026-76380MEDIUMInformation Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAREPSS 0.1%CVE-2026-76376MEDIUMInformation Disclosure through Action Parameters in AWS IAM app for Splunk SOAREPSS 0.1%CVE-2026-76405MEDIUMInformation Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) appEPSS 0.1%CVE-2026-76386MEDIUMInformation Disclosure through Action Parameters in Zoom app for Splunk SOAREPSS 0.1%CVE-2024-53979HIGHAnsible collection "ibm.ibm_zhmc" has passwords in clear text in log file and in output of some modules when specified as inputEPSS 0.1%CVE-2026-76384MEDIUMInformation Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAREPSS 0.1%CVE-2025-53670MEDIUMJenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml fiEPSS 0.1%CVE-2022-2569MEDIUMARC Informatique PcVueEPSS 0.1%CVE-2024-36119LOWPassword confirmation stored in plain text via registration form in statamic/cmsEPSS 0.1%CVE-2022-42931LOWLogins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk. Instead, the usernaEPSS 0.1%CVE-2023-26593HIGHCENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who canEPSS 0.1%CVE-2024-53865HIGHPython package "zhmcclient" has passwords in clear text in its HMC and API logsEPSS 0.1%CVE-2026-44940MEDIUMService token exposure and potential privilege escalation in SUSE ObservabilityEPSS 0.1%CVE-2025-3442MEDIUMInformation Disclosure Vulnerability in TP-Link Tapo IoT Smart HubEPSS 0.1%CVE-2026-4387LOWUnencrypted storage of authentication state in StrongDM Desktop Application state.kv fileEPSS 0.1%CVE-2025-55280MEDIUMInformation Disclosure Vulnerability in ZKTeco WL20EPSS 0.1%CVE-2025-2922LOWNetis WF-2404 BusyBox Shell cleartext storageEPSS 0.1%CVE-2022-31697MEDIUMThe vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with aEPSS 0.1%CVE-2023-24964MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.1%