Falhas do tipo CWE-359

218 resultados

Violação de Privacidade

É quando um sistema expõe informações sensíveis de usuários (dados pessoais, credenciais, histórico de atividades) para quem não deveria ter acesso. Pode ocorrer por falha em controle de acesso, logs inadequados, cache inseguro ou falta de criptografia em trânsito/repouso.

Exemplo

Uma API REST que retorna email e CPF de outros usuários ao consultar um endpoint de perfil sem validar se o solicitante tem permissão; ou um sistema que registra senhas em log de erro visível aos administradores.

Como mitigar

Implemente controle de acesso rigoroso (verifique permissão antes de expor dados), evite armazenar dados sensíveis em logs/cache, criptografe dados em repouso e em trânsito (HTTPS, TLS), e aplique princípio de menor privilégio nas queries de banco de dados.

CVE-2025-43389MEDIUMA privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1EPSS 0.2%CVE-2026-54565MEDIUMrhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pagesEPSS 0.2%CVE-2024-41780MEDIUMIBM Jazz Foundation information disclosureEPSS 0.2%CVE-2025-43469MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS TahoEPSS 0.2%CVE-2025-1939LOWTapjacking in Android Custom Tabs using transition animationsEPSS 0.2%CVE-2025-36131MEDIUMIBM Db2 information disclosureEPSS 0.2%CVE-2025-53950MEDIUMAn Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin fEPSS 0.2%CVE-2023-44213LOWSensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber ProteEPSS 0.2%CVE-2025-11598LOWExposure of Confidential Information in mObywatel applicationEPSS 0.2%CVE-2023-48680LOWSensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber ProteEPSS 0.2%CVE-2025-6017MEDIUMRhacm: users with clusterreader role can see credentials from managed-clustersEPSS 0.2%CVE-2026-24078MEDIUMExposure of Private Personal Information to an Unauthorized Actor in Data ModemEPSS 0.2%CVE-2025-52602MEDIUMHCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query applicationEPSS 0.2%CVE-2026-28963MEDIUMA privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical acEPSS 0.2%CVE-2025-35981MEDIUMExposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to vieEPSS 0.1%CVE-2025-5009LOWInformation Disclosure in Gemini iOS AppEPSS 0.1%CVE-2025-30459MEDIUMA privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensiEPSS 0.1%CVE-2025-10859MEDIUMData stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabsEPSS 0.1%