Falhas do tipo CWE-359

218 resultados

Violação de Privacidade

É quando um sistema expõe informações sensíveis de usuários (dados pessoais, credenciais, histórico de atividades) para quem não deveria ter acesso. Pode ocorrer por falha em controle de acesso, logs inadequados, cache inseguro ou falta de criptografia em trânsito/repouso.

Exemplo

Uma API REST que retorna email e CPF de outros usuários ao consultar um endpoint de perfil sem validar se o solicitante tem permissão; ou um sistema que registra senhas em log de erro visível aos administradores.

Como mitigar

Implemente controle de acesso rigoroso (verifique permissão antes de expor dados), evite armazenar dados sensíveis em logs/cache, criptografe dados em repouso e em trânsito (HTTPS, TLS), e aplique princípio de menor privilégio nas queries de banco de dados.

CVE-2024-8891MEDIUMExposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMTEPSS 0.3%CVE-2026-88875MEDIUMAVideo Incomplete API Sanitization Information DisclosureEPSS 0.3%CVE-2024-11216HIGHBroken Access Control in PozitifIK's Pik OnlineEPSS 0.3%CVE-2025-1030HIGHSensitive Data Exposure in Utarit Informatics' SoliClubEPSS 0.3%CVE-2024-42325LOWExcessive information returned by user.getEPSS 0.3%CVE-2025-43259MEDIUMThis issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, mEPSS 0.3%CVE-2025-11959HIGHImproper Access Control in Premierturk's Excavation Management Information SystemEPSS 0.3%CVE-2025-3035MEDIUMTab title disclosure across pages when using AI chatbotEPSS 0.3%CVE-2025-14317HIGHUser Enumeration in Crazy Bubble Tea mobile applicationEPSS 0.3%CVE-2025-3950LOWExposure of Private Personal Information to an Unauthorized Actor in GitLabEPSS 0.3%CVE-2024-44113MEDIUMInformation Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer)EPSS 0.3%CVE-2024-41729MEDIUMInformation Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)EPSS 0.3%CVE-2025-15623CRITICALSparx Pro Cloud Server reveals sensitive information to an unauthenticated userEPSS 0.3%CVE-2026-24321MEDIUMInformation Disclosure vulnerability in SAP Commerce CloudEPSS 0.3%CVE-2024-49386MEDIUMSensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0EPSS 0.2%CVE-2026-21827LOWHCL Connections is vulnerable to an information disclosure vulnerabilityEPSS 0.2%CVE-2025-43452MEDIUMThis issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 26.1 and iPadOS 26.1. Keyboard suggesEPSS 0.2%CVE-2024-37533LOWIBM InfoSphere Information Server information disclosureEPSS 0.2%CVE-2025-20615MEDIUMQardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized ActorEPSS 0.2%CVE-2025-53374LOWDokploy Improperly Discloses User Information via user.one EndpointEPSS 0.2%