Weaknesses of type CWE-250

399 results

Execução com Privilégios Desnecessários

Ocorre quando um processo ou aplicação executa com mais privilégios (permissões) do que realmente precisa para funcionar. Se o código é comprometido ou contém uma vulnerabilidade, o atacante herda todos esses privilégios elevados, ampliando drasticamente o dano possível.

Example

Um serviço web que processa uploads de arquivo rodando como root (ou SYSTEM no Windows) em vez de um usuário sem privilégios. Se a aplicação sofrer uma injeção de código, o atacante ganha controle total da máquina, não apenas do serviço.

How to mitigate

Execute aplicações com a menor quantidade de permissões necessária (princípio do menor privilégio): use contas de serviço dedicadas, separe componentes críticos, e aplique drop de privilégios após inicialização. Revise regularmente quais permissões cada processo realmente usa.

CVE-2025-9055MEDIUMThe VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privilegesEPSS 0.1%CVE-2026-3315MEDIUMLocal Privilege Escalation Due to Writable Executable in Privileged Visionline Service PathEPSS 0.1%CVE-2026-40550MEDIUMPrivilege Escalation in multiple BinSoft productsEPSS 0.1%CVE-2026-40638MEDIUMDell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability. A high privileged EPSS 0.1%CVE-2025-46696MEDIUMDell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary EPSS 0.1%CVE-2026-75621MEDIUMIBM Aspera Enterprise Webapps Execution with Unnecessary PrivilegesEPSS 0.1%CVE-2025-1790MEDIUMLocal privilege escalation in Genetec Sipelia Plugin. An authenticated low-privileged Windows user could exploit this vulnerability to gain EPSS 0.1%CVE-2026-20037MEDIUMCisco UCS Manager File Write VulnerabilityEPSS 0.1%CVE-2025-34290HIGHVersa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege EscalationEPSS 0.1%CVE-2026-11626MEDIUMLocal Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal ToolEPSS 0.1%CVE-2025-36059MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%CVE-2026-42061HIGHLocal privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLockEPSS 0.1%CVE-2026-4667HIGHHP System Optimizer - Escalation of PrivilegeEPSS 0.1%CVE-2025-12694HIGHLocal Privilege Escalation in VPN ClientEPSS 0.1%CVE-2025-0079HIGHIn multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This couEPSS 0.1%CVE-2025-0080HIGHIn multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This coulEPSS 0.1%CVE-2026-25908MEDIUMDell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCCEPSS 0.1%CVE-2026-110150MEDIUMPrivilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive informatEPSS 0.1%CVE-2025-48573HIGHIn sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due tEPSS 0.1%