Weaknesses of type CWE-250

399 results

Execução com Privilégios Desnecessários

Ocorre quando um processo ou aplicação executa com mais privilégios (permissões) do que realmente precisa para funcionar. Se o código é comprometido ou contém uma vulnerabilidade, o atacante herda todos esses privilégios elevados, ampliando drasticamente o dano possível.

Example

Um serviço web que processa uploads de arquivo rodando como root (ou SYSTEM no Windows) em vez de um usuário sem privilégios. Se a aplicação sofrer uma injeção de código, o atacante ganha controle total da máquina, não apenas do serviço.

How to mitigate

Execute aplicações com a menor quantidade de permissões necessária (princípio do menor privilégio): use contas de serviço dedicadas, separe componentes críticos, e aplique drop de privilégios após inicialização. Revise regularmente quais permissões cada processo realmente usa.

CVE-2025-55077MEDIUMTyler Technologies ERP Pro 9 SaaS application escapeEPSS 0.2%CVE-2024-24245HIGHAn issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the EPSS 0.2%CVE-2022-34384HIGH Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | UpdaEPSS 0.2%CVE-2025-0921MEDIUMInformation Tampering Vulnerability in Multiple Services of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizVizEPSS 0.2%CVE-2024-0084HIGHCVEEPSS 0.2%CVE-2024-35142HIGHIBM Security Verify Access privilege escalationEPSS 0.2%CVE-2024-35141HIGHIBM Security Verify Access privilege escalationEPSS 0.2%CVE-2026-12027CRITICALInappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the rendererEPSS 0.2%CVE-2025-1951HIGHIBM Hardware Management Console - Power Systems command executionEPSS 0.2%CVE-2026-1680HIGHLocal Privilege Escalation in Local Admin ServiceEPSS 0.2%CVE-2025-61909MEDIUMIcinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon userEPSS 0.2%CVE-2025-0416HIGHValmet DNA Local privilege escalation through insecure DCOM configurationEPSS 0.2%CVE-2025-57780HIGHF5OS VulnerabilityEPSS 0.2%CVE-2024-52799HIGHArgo Workflows Chart: Excessive Privileges in Workflow RoleEPSS 0.2%CVE-2026-91335LOWVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). EPSS 0.2%CVE-2022-24113—Local privilege escalation due to excessive permissions assigned to child processesEPSS 0.2%CVE-2021-38118MEDIUMPossible Local Privilege Escalation Vulnerability in OpenText iManagerEPSS 0.2%CVE-2021-0256MEDIUMJunos OS: mosquitto Local Privilege Escalation vulnerability in SUID binariesEPSS 0.2%CVE-2024-21924HIGHSMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentiallyEPSS 0.2%CVE-2024-11075HIGHSICK Incoming Goods Suite privilege escalation vulnerabilityEPSS 0.2%