Falhas do tipo CWE-312

498 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2023-32455MEDIUM Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious uEPSS 0.1%CVE-2026-75847MEDIUMSensitive attribute values stored in a non-sensitive public changes map in AshPaperTrailEPSS 0.1%CVE-2023-32446MEDIUM Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious uEPSS 0.1%CVE-2026-77970MEDIUMSensitive fields nested in embedded values are not redacted in AshPaperTrail versionsEPSS 0.1%CVE-2023-32447MEDIUM Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local acEPSS 0.1%CVE-2026-76385MEDIUMInformation Disclosure through Action Parameters in Venafi app for Splunk SOAREPSS 0.1%CVE-2025-6748LOWBharti Airtel Thanks App files cleartext storage in a file or on diskEPSS 0.1%CVE-2023-41096MEDIUMKeys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet devicesEPSS 0.1%CVE-2026-66016MEDIUMRendered Artifactory Helm manifests may contain generated TLS private keysEPSS 0.1%CVE-2025-34428HIGHMailEnable < 10.54 Cleartext Credential Storage in AUTH.SAVEPSS 0.1%CVE-2023-32448MEDIUM PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user with access to the instEPSS 0.1%CVE-2025-0123MEDIUMPAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet CapturesEPSS 0.1%CVE-2024-31415MEDIUMThe Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network manageEPSS 0.1%CVE-2022-4312MEDIUM A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized uEPSS 0.1%CVE-2023-39440MEDIUMInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.1%CVE-2024-23942HIGHMB connect line: Configuration File on the client workstation is not encryptedEPSS 0.1%CVE-2025-34427HIGHMailEnable < 10.54 Cleartext Credential Storage in AUTH.TABEPSS 0.1%CVE-2024-25023MEDIUMIBM QRadar Suite Software information disclosureEPSS 0.1%CVE-2023-46294LOWAn issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted locally, and can be decrypted to cleartext passwEPSS 0.1%CVE-2026-77250MEDIUMMCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissionsEPSS 0.1%