Falhas do tipo CWE-538

106 resultados

Exposição de informações sensíveis em arquivos ou diretórios acessíveis externamente

A aplicação escreve dados sensíveis (senhas, tokens, chaves API, PII) em arquivos ou diretórios que podem ser acessados por usuários não autorizados ou pela internet. Isso acontece por falta de controle de permissões adequado ou armazenamento em local público, expondo credenciais e dados críticos.

Exemplo

Um aplicativo salva chaves de acesso ao banco de dados em um arquivo .config dentro da raiz web, ou gera logs de debug contendo tokens de autenticação em /tmp acessível globalmente. Um atacante consegue ler esses arquivos e comprometer a aplicação ou dados do usuário.

Como mitigar

Armazene dados sensíveis fora do escopo web (diretório não servido), use variáveis de ambiente ou sistemas de gestão de secrets (Vault, AWS Secrets Manager), aplique permissões restritivas (chmod 600) e evite logar ou cachear credenciais em texto plano.

CVE-2025-22633MEDIUMWordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-24689MEDIUMWordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-31421MEDIUMWordPress Srbtranslatin plugin <= 3.2.0 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-58458MEDIUMIn Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the EPSS 0.3%CVE-2025-61138HIGHQlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.EPSS 0.3%CVE-2023-54346HIGHWordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup DownloadEPSS 0.3%CVE-2026-6160MEDIUMcode-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosureEPSS 0.3%CVE-2025-36372MEDIUMIBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tablesEPSS 0.3%CVE-2022-4318HIGHCri-o: /etc/passwd tampering privescEPSS 0.3%CVE-2022-20864MEDIUMCisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-114195MEDIUMWordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-8452MEDIUMUnauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.EPSS 0.3%CVE-2018-4847—A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive informaEPSS 0.3%CVE-2022-43933MEDIUMconfiguration secrets are logged in support-saveEPSS 0.3%CVE-2025-68429HIGHStorybook manager bundle may expose environment variables during buildEPSS 0.3%CVE-2026-50565MEDIUMFission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder containerEPSS 0.3%CVE-2026-33705MEDIUMChamilo LMS has unauthenticated access to Twig template source files exposes application logicEPSS 0.2%CVE-2026-56065HIGHWordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-21672HIGHA vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.EPSS 0.2%CVE-2022-0013MEDIUMCortex XDR Agent: File Information Exposure Vulnerability When Generating Support FileEPSS 0.2%