Falhas do tipo CWE-312

423 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2020-27986HIGHSonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE:EPSS 16.2%CVE-2016-8366—Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pEPSS 5.8%CVE-2020-5723—The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve allEPSS 5.7%CVE-2025-22896CRITICALmySCADA myPRO Manager Cleartext Storage of Sensitive InformationEPSS 3.4%CVE-2025-27532MEDIUMA vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attEPSS 3.3%CVE-2021-36782CRITICALRancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectEPSS 3.1%CVE-2026-22240CRITICALPlaintext Passwords Vulnerability in BLUVOYIXEPSS 3.0%CVE-2011-4723MEDIUMThe D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecifiEPSS 3.0%KEVCVE-2014-5433—An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on BaxtEPSS 2.1%CVE-2023-40238MEDIUMA LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.EPSS 1.9%CVE-2023-22894CRITICALStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. ThEPSS 1.7%CVE-2024-3742HIGHElectrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive InformationEPSS 1.4%CVE-2017-2672MEDIUMA flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log EPSS 1.2%CVE-2017-9663—An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. SuccEPSS 1.1%CVE-2017-9654—The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend syEPSS 1.1%CVE-2015-3952—Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and EPSS 1.0%CVE-2018-10871LOW389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica anEPSS 1.0%CVE-2020-9045CRITICALC•CURE 9000 and victor Video Management System - Cleartext storage of user credentials upon installation or upgrade of software.EPSS 1.0%CVE-2026-23655MEDIUMMicrosoft ACI Confidential Containers Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-21339MEDIUMCleartext storage of session identifierEPSS 0.9%