Weaknesses of type CWE-250

399 results

Execução com Privilégios Desnecessários

Ocorre quando um processo ou aplicação executa com mais privilégios (permissões) do que realmente precisa para funcionar. Se o código é comprometido ou contém uma vulnerabilidade, o atacante herda todos esses privilégios elevados, ampliando drasticamente o dano possível.

Example

Um serviço web que processa uploads de arquivo rodando como root (ou SYSTEM no Windows) em vez de um usuário sem privilégios. Se a aplicação sofrer uma injeção de código, o atacante ganha controle total da máquina, não apenas do serviço.

How to mitigate

Execute aplicações com a menor quantidade de permissões necessária (princípio do menor privilégio): use contas de serviço dedicadas, separe componentes críticos, e aplique drop de privilégios após inicialização. Revise regularmente quais permissões cada processo realmente usa.

CVE-2026-22008LOWVulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to expEPSS 0.2%CVE-2026-46748HIGHA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configureEPSS 0.2%CVE-2025-55002MEDIUMJupyterLab Desktop: TCC Bypass via Misconfigured Node FusesEPSS 0.2%CVE-2024-47120MEDIUMIBM Security Verify Information Queue code executionEPSS 0.2%CVE-2025-58431MEDIUMZimaOS reads arbitrary files using localhost calls to File API DownloadEPSS 0.2%CVE-2021-0255MEDIUMJunos OS: ethtraceroute Local Privilege Escalation vulnerability in SUID binariesEPSS 0.2%CVE-2023-20210MEDIUMA vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected devicEPSS 0.2%CVE-2022-38695HIGHIn BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privilEPSS 0.2%CVE-2026-21882HIGHtheshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-executionEPSS 0.2%CVE-2024-48837HIGHDell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulneEPSS 0.2%CVE-2026-67609HIGHTelenia TVox 26.5.3 Privilege Escalation via Insecure sudoers ConfigurationEPSS 0.2%CVE-2022-3088HIGHUC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v EPSS 0.2%CVE-2022-30695—Local privilege escalation due to excessive permissions assigned to child processesEPSS 0.2%CVE-2026-121196—Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictioEPSS 0.2%CVE-2022-22239HIGHJunos OS Evolved: The ssh CLI command always runs as root which can lead to privilege escalationEPSS 0.2%CVE-2022-41290HIGHIBM AIX privilege escalationEPSS 0.2%CVE-2025-3925HIGHBrightSign Players Execution with Unnecessary PrivilegesEPSS 0.2%CVE-2026-48098HIGHNexTOR IP Changer Unsafely Uses sudo and shell=TrueEPSS 0.2%CVE-2024-8781HIGHContainer Escape Vulnerability in TR7's Application Security Platform (ASP)EPSS 0.2%CVE-2025-54991MEDIUMJupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)EPSS 0.2%