Falhas do tipo CWE-209

392 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2025-9977MEDIUMImproper neutralization of input in Times Software E-PAYROLLEPSS 2.2%CVE-2018-10913LOWAn information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to deEPSS 2.1%CVE-2017-2594MEDIUMhawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerEEPSS 2.0%CVE-2018-1073MEDIUMThe web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, alloEPSS 1.9%CVE-2012-0059MEDIUMSpacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messagesEPSS 1.6%CVE-2020-15125HIGHAuthorization header is not sanitized in an error object in auth0EPSS 1.5%CVE-2024-23945MEDIUMApache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification failsEPSS 1.5%CVE-2017-2659MEDIUMIt was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is EPSS 1.5%CVE-2024-21313MEDIUMWindows TCP/IP Information Disclosure VulnerabilityEPSS 1.5%CVE-2023-25956HIGHApache Airflow AWS Provider: Arbitrary file read via AWS providerEPSS 1.5%CVE-2016-9459—Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a localEPSS 1.5%CVE-2020-14337—A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticEPSS 1.5%CVE-2021-20289—A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the EPSS 1.4%CVE-2018-14623MEDIUMA SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SEPSS 1.4%CVE-2017-7551—389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different returEPSS 1.4%CVE-2022-2062CRITICALGeneration of Error Message Containing Sensitive Information in nocodb/nocodbEPSS 1.4%CVE-2022-31140HIGHValinor error messages leading to potential data exfiltrationEPSS 1.4%CVE-2023-25695MEDIUMInformation disclosure in Apache AirflowEPSS 1.4%CVE-2021-32734LOWFile path disclosure of shared files in Nextcloud Text applicationEPSS 1.4%CVE-2021-32766MEDIUMNextcloud Text app can disclose existence of folders in "File Drop" link shareEPSS 1.3%