Falhas do tipo CWE-312

496 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2026-20312HIGHCisco Catalyst SD-WAN Security Hardening Release - Information Disclosure VulnerabilitiesEPSS 0.3%CVE-2024-46505CRITICALInfoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.EPSS 0.3%CVE-2025-25758HIGHAn issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdEPSS 0.3%CVE-2026-25751CRITICALFUXA Unauthenticated Exposure of Plaintext Database CredentialsEPSS 0.3%CVE-2026-63406MEDIUMAnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including SecretsEPSS 0.3%CVE-2026-47702CRITICALTypeBot API tokens stored in plaintextEPSS 0.3%CVE-2023-41964MEDIUMBIG-IP and BIG-IQ Database Variable vulnerabilityEPSS 0.3%CVE-2026-107807HIGHNginx UI: Node Secret Credential Exposure via URL Query ParameterEPSS 0.3%CVE-2025-65826CRITICALThe mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and foundEPSS 0.3%CVE-2026-31848HIGHReversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+EPSS 0.3%CVE-2026-15721CRITICALQuery Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.3%CVE-2024-34891MEDIUMInsufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange aEPSS 0.3%CVE-2025-62261MEDIUMLiferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92EPSS 0.3%CVE-2019-14886MEDIUMA vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_securitEPSS 0.3%CVE-2025-12772HIGHPlaintext Switch admin login password is seen in Brocade SANnav support saveEPSS 0.3%CVE-2022-22302MEDIUMA clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 andEPSS 0.3%CVE-2025-54537MEDIUMIn JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshotsEPSS 0.3%CVE-2025-54538MEDIUMIn JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" commandEPSS 0.3%CVE-2025-23027MEDIUMBASEHUB_TOKEN commited in next-forgeEPSS 0.3%CVE-2020-11918MEDIUMAn issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on aEPSS 0.3%