Falhas do tipo CWE-312

502 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2026-16802MEDIUMCleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local EPSS 0.1%CVE-2025-58401MEDIUMObsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthEPSS 0.1%CVE-2026-22276MEDIUMDell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive InformEPSS 0.1%CVE-2026-24311MEDIUMInsecure Storage Protection vulnerability in SAP Customer Checkout 2.0EPSS 0.1%CVE-2026-105271MEDIUM"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtainEPSS 0.1%CVE-2024-9432MEDIUMCleartext Storage of Sensitive Information vulnerability has been discovered in OpenText™ Vertica.EPSS 0.1%CVE-2025-40752MEDIUMA vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (EPSS 0.1%CVE-2025-40753MEDIUMA vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (EPSS 0.1%CVE-2025-3395HIGHIncorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.ThEPSS 0.1%CVE-2025-54855MEDIUMAutomationDirect CLICK PLUS Cleartext Storage of Sensitive InformationEPSS 0.1%CVE-2026-80058MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Cleartext Storage EPSS 0.1%CVE-2026-19864MEDIUMEclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintexEPSS 0.1%CVE-2025-55717LOWA cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.EPSS 0.1%CVE-2025-33081LOWMultiple Vulnerabilities in IBM Concert Software.EPSS 0.1%CVE-2025-14815CRITICALInformation Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64EPSS 0.1%CVE-2026-45362LOWSangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.EPSS 0.1%CVE-2025-11009MEDIUMInformation Disclosure Vulnerability in GT Designer3EPSS 0.1%CVE-2025-63729CRITICALAn issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA CertifEPSS 0.1%CVE-2026-36176HIGHGNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. This allows EPSS 0.1%CVE-2024-39674MEDIUMPlaintext vulnerability in the Gallery search module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%