Falhas do tipo CWE-312

423 resultados

Divulgação de Informações Sensíveis

Ocorre quando a aplicação expõe dados sensíveis (senhas, tokens, chaves criptográficas, PII) através de canais inseguros, logs, mensagens de erro verbosas ou armazenamento inadequado. O risco é que um atacante ou observador não autorizado capture essas informações e as use para comprometer a segurança do sistema ou dos usuários.

Exemplo

Uma API retorna stacktrace completo em resposta de erro, revelando caminhos internos do servidor; uma aplicação escreve senhas em plain text nos logs; credenciais são transmitidas via HTTP em vez de HTTPS; tokens de autenticação ficam expostos no histórico do browser ou em variáveis de ambiente visíveis.

Como mitigar

Nunca exponha dados sensíveis em mensagens de erro, logs ou respostas HTTP — use apenas IDs de erro genéricos. Sempre transmita credenciais por canais criptografados (TLS/HTTPS). Armazene segredos em vaults (HashiCorp Vault, AWS Secrets Manager) e nunca em código, configurações ou logs. Revise regularmente logs, caches e históricos para remover informações classificadas.

CVE-2021-1265HIGHCisco DNA Center Information Disclosure VulnerabilityEPSS 0.9%CVE-2020-8225—A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authenticaEPSS 0.9%CVE-2024-29146MEDIUMUser passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump fiEPSS 0.9%CVE-2020-7513—A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could alEPSS 0.8%CVE-2022-25164HIGHCleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi ElecEPSS 0.8%CVE-2020-26288HIGHParse Server stores password in plain textEPSS 0.8%CVE-2015-1012—Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeEPSS 0.8%CVE-2025-34216CRITICALVasion Print (formerly PrinterLogic) RCE and Password Leaks via APIEPSS 0.8%CVE-2025-27622MEDIUMJenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via RESEPSS 0.8%CVE-2023-22332MEDIUMInformation disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 seriEPSS 0.7%CVE-2020-15105MEDIUMIn Django Two-Factor Authentication, user passwords are stored in clear text in the Django sessionEPSS 0.7%CVE-2022-29826MEDIUMCleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control EPSS 0.7%CVE-2024-45175HIGHAn issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that EPSS 0.7%CVE-2020-26228HIGHCleartext storage of session identifierEPSS 0.7%CVE-2019-3753HIGHDell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password EPSS 0.6%CVE-2024-40457CRITICALNo-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's positionEPSS 0.6%CVE-2019-14825MEDIUMA cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during conEPSS 0.6%CVE-2021-35035MEDIUMA cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtEPSS 0.6%CVE-2017-3214—The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary.EPSS 0.6%CVE-2024-6400HIGHCleartext Storage of Username and Password in Finrota's NetahsilatEPSS 0.6%