Weaknesses of type CWE-312

423 results

Divulgação de informações sensíveis

A aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais) através de mecanismos que não deveria — logs, mensagens de erro, respostas HTTP, cache ou armazenamento inseguro. O risco é que um atacante, desenvolvedor ou qualquer pessoa com acesso ao sistema consegue extrair informações que comprometerem segurança ou privacidade.

Example

Uma API retorna mensagem de erro com detalhes da query SQL executada, ou logs de produção armazenam senhas em texto plano, ou resposta HTTP carrega um token JWT sem flag HttpOnly — em todos os casos, dados que deveriam ser secretos ficam acessíveis a quem não deveria.

How to mitigate

Sanitize mensagens de erro (retorne genéricas ao cliente, detalhe apenas em logs privados); nunca registre senhas, tokens ou PII em logs; use flags seguras em cookies (HttpOnly, Secure, SameSite); implemente controle de acesso a logs e artifacts; criptografe dados em repouso e em trânsito; revise regularmente o que está sendo exposto em respostas HTTP e exceções.

CVE-2020-27986HIGHSonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE:EPSS 16.2%CVE-2016-8366—Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pEPSS 5.8%CVE-2020-5723—The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve allEPSS 5.7%CVE-2025-22896CRITICALmySCADA myPRO Manager Cleartext Storage of Sensitive InformationEPSS 3.4%CVE-2025-27532MEDIUMA vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attEPSS 3.3%CVE-2021-36782CRITICALRancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectEPSS 3.1%CVE-2026-22240CRITICALPlaintext Passwords Vulnerability in BLUVOYIXEPSS 3.0%CVE-2011-4723MEDIUMThe D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecifiEPSS 3.0%KEVCVE-2014-5433—An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on BaxtEPSS 2.1%CVE-2023-40238MEDIUMA LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.EPSS 1.9%CVE-2023-22894CRITICALStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. ThEPSS 1.7%CVE-2024-3742HIGHElectrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive InformationEPSS 1.4%CVE-2017-2672MEDIUMA flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log EPSS 1.2%CVE-2017-9663—An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. SuccEPSS 1.1%CVE-2017-9654—The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend syEPSS 1.1%CVE-2015-3952—Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and EPSS 1.0%CVE-2018-10871LOW389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica anEPSS 1.0%CVE-2020-9045CRITICALC•CURE 9000 and victor Video Management System - Cleartext storage of user credentials upon installation or upgrade of software.EPSS 1.0%CVE-2026-23655MEDIUMMicrosoft ACI Confidential Containers Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-21339MEDIUMCleartext storage of session identifierEPSS 0.9%