Falhas do tipo CWE-202

37 resultados

Exposição de informações sensíveis através de consultas de dados

Ocorre quando uma aplicação expõe dados sensíveis (senhas, tokens, informações pessoais) ao processar ou retornar resultados de consultas — seja em APIs, logs, mensagens de erro ou respostas a buscas. O desenvolvedor não filtra ou mascara adequadamente o que sai do sistema, permitindo que um atacante intercepte ou consulte diretamente essas informações.

Exemplo

Uma API de busca de usuários retorna resultado como {"id": 123, "nome": "João", "email": "joao@mail.com", "senha_hash": "abc123def", "token_api": "xyz789"}. Um atacante enumera IDs e coleta credenciais diretamente das respostas da busca.

Como mitigar

Implemente whitelist de campos retornáveis em consultas (retorne apenas id, nome, email — nunca senha ou tokens). Use serializers/DTOs que excluam explicitamente dados sensíveis, e valide permissões do usuário antes de expor qualquer informação em respostas.

CVE-2026-42797MEDIUMApache Syncope: JexlContextBuilder Information DisclosureEPSS 0.4%CVE-2024-20388MEDIUMA vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote atEPSS 0.4%CVE-2021-1372MEDIUMCisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-38897MEDIUMWAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.EPSS 0.4%CVE-2024-38892MEDIUMAn issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.EPSS 0.4%CVE-2024-38895MEDIUMWAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.EPSS 0.4%CVE-2026-25050LOWVendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyEPSS 0.4%CVE-2025-29981HIGHDell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An EPSS 0.4%CVE-2024-2088HIGHNextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information ExposureEPSS 0.3%CVE-2025-64504MEDIUMLangfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIsEPSS 0.3%CVE-2025-36575HIGHDell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An uEPSS 0.3%CVE-2025-64528MEDIUMUsers are able to find users by name even when `enable_names` is offEPSS 0.3%CVE-2026-70473HIGHFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyEPSS 0.2%CVE-2021-4159—A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be retEPSS 0.2%CVE-2026-3546MEDIUMe-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX ActionEPSS 0.2%CVE-2026-25703HIGHPotential information leakage from manager /network/graph API in NeuVectorEPSS 0.2%CVE-2026-33530HIGHInvenTree Vulnerable to ORM Filter InjectionEPSS 0.2%