Falhas do tipo CWE-312

501 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2023-46294LOWAn issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted locally, and can be decrypted to cleartext passwEPSS 0.1%CVE-2024-25023MEDIUMIBM QRadar Suite Software information disclosureEPSS 0.1%CVE-2025-53103MEDIUMJUnit OpenTestReportGeneratingListener can leak Git credentialsEPSS 0.1%CVE-2024-28807MEDIUMAn issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @CT desktop managementEPSS 0.1%CVE-2024-29954MEDIUMpassword management API prints sensitive information in log filesEPSS 0.1%CVE-2024-8070HIGHCWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binaryEPSS 0.1%CVE-2026-55997HIGHLong-lived Rancher registration token exposed in plaintextEPSS 0.1%CVE-2024-29952MEDIUMClear text storage of sensistive information by manipulating command variables EPSS 0.1%CVE-2024-51993LOWPassword is stored in clear in the database in Combodo iTopEPSS 0.1%CVE-2025-7215LOWFNKvision FNK-GU2 wpa_supplicant.conf cleartext storageEPSS 0.1%CVE-2024-41688HIGHCleartext Storage of Sensitive Information VulnerabilityEPSS 0.1%CVE-2026-73834MEDIUMMust-gather: must-gather: embedded secret data in acm wrapper crs collected without redactionEPSS 0.1%CVE-2026-109426HIGHTelegram-Stremio 5.1.0 Insecure Session Storage via encode_stringEPSS 0.1%CVE-2024-28024MEDIUMA vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessibEPSS 0.1%CVE-2025-59450MEDIUMThe YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials.EPSS 0.1%CVE-2024-58023HIGHInformation disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.EPSS 0.1%CVE-2026-96549MEDIUMsfturing hosp_order CommonUserServiceImpl.java cleartext storageEPSS 0.1%CVE-2026-18591LOWMeesho Online Shopping App com.meesho.supply cleartext storageEPSS 0.1%CVE-2024-10404MEDIUMClear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsaveEPSS 0.1%CVE-2025-59105HIGHUnencrypted Flash Storage in dormakaba access managerEPSS 0.1%