Weaknesses of type CWE-209

392 results

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação retorna mensagens de erro que revelam detalhes internos do sistema — como caminhos de arquivo, nomes de banco de dados, versões de software ou stack traces — para usuários não autorizados. Um atacante usa essas informações para mapear a infraestrutura e planejar exploits direcionados.

Example

Um formulário de login mostra 'Erro SQL: usuário não encontrado em tabela users_prod' ao invés de 'Credenciais inválidas'. O atacante descobre o nome exato da tabela e começa testes de SQL injection. Ou um erro de exceção expõe '/var/www/html/config.php:42', revelando a estrutura do servidor.

How to mitigate

Exiba mensagens de erro genéricas ao usuário final ('Operação não permitida'), e registre os detalhes técnicos apenas em logs internos do servidor. Desabilite stack traces e debug info em produção, use tratamento centralizado de exceções e valide/sanitize todo output antes de devolvê-lo ao cliente.

CVE-2024-29059HIGH.NET Framework Information Disclosure VulnerabilityEPSS 98.6%KEVCVE-2025-62168CRITICALSquid vulnerable to information disclosure via authentication credential leakage in error handlingEPSS 62.9%CVE-2025-47813MEDIUMloginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UIEPSS 58.7%KEVCVE-2013-7331MEDIUMThe Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnaEPSS 58.0%KEVCVE-2021-30357—SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows pEPSS 22.8%CVE-2024-21733MEDIUMApache Tomcat: Leaking of unrelated request bodies in default error pageEPSS 14.3%CVE-2024-45440MEDIUMcore/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_coEPSS 9.3%CVE-2022-29266—apisix/jwt-auth may leak secrets in error responseEPSS 7.8%CVE-2022-0660CRITICALGeneration of Error Message Containing Sensitive Information in microweber/microweberEPSS 6.9%CVE-2026-29146HIGHApache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultEPSS 6.3%CVE-2023-20593—An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive informationEPSS 5.2%CVE-2018-12536—In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doEPSS 4.3%CVE-2024-39719HIGHAn issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route witEPSS 4.3%CVE-2021-22885—A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymEPSS 4.2%CVE-2023-27587HIGHReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive informatioEPSS 3.9%CVE-2026-22778CRITICALvLLM leaks a heap address when PIL throws an errorEPSS 3.7%CVE-2021-25958MEDIUMGeneration of Error Message Containing Sensitive Information in Apache OFBizEPSS 2.6%CVE-2024-44762MEDIUMA discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.EPSS 2.6%CVE-2019-7612—A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is sEPSS 2.4%CVE-2024-28939HIGHMicrosoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.3%