Weaknesses of type CWE-250

399 results

Execução com Privilégios Desnecessários

Ocorre quando um processo ou aplicação executa com mais privilégios (permissões) do que realmente precisa para funcionar. Se o código é comprometido ou contém uma vulnerabilidade, o atacante herda todos esses privilégios elevados, ampliando drasticamente o dano possível.

Example

Um serviço web que processa uploads de arquivo rodando como root (ou SYSTEM no Windows) em vez de um usuário sem privilégios. Se a aplicação sofrer uma injeção de código, o atacante ganha controle total da máquina, não apenas do serviço.

How to mitigate

Execute aplicações com a menor quantidade de permissões necessária (princípio do menor privilégio): use contas de serviço dedicadas, separe componentes críticos, e aplique drop de privilégios após inicialização. Revise regularmente quais permissões cada processo realmente usa.

CVE-2021-37174—A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCEPSS 1.2%CVE-2023-4662CRITICALRCE in Saphira ConnectEPSS 1.2%CVE-2020-2023LOWKata Containers - Containers have access to the guest root filesystem deviceEPSS 1.1%CVE-2022-43553HIGHA remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account EPSS 1.1%CVE-2018-10892MEDIUMThe default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw alloEPSS 1.1%CVE-2025-5196HIGHWing FTP Server Lua Admin Console unnecessary privilegesEPSS 1.1%CVE-2024-27143CRITICALPre-authenticated Remote Code ExecutionEPSS 1.1%CVE-2026-77521CRITICALMaxKB: Prompt-injectable agent can lead to command executionEPSS 1.0%CVE-2022-2634CRITICALDigi ConnectPort X2DEPSS 1.0%CVE-2022-40182—A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DEPSS 1.0%CVE-2023-27010HIGHWondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escEPSS 1.0%CVE-2026-69409MEDIUMMicrosoft Office SharePoint Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-3576HIGHPrivilege escalation via SeImpersonatePrivilegeEPSS 0.9%CVE-2022-44544CRITICALMahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger EPSS 0.9%CVE-2023-32080CRITICALWings vulnerable to escape to host from installation containerEPSS 0.9%CVE-2023-1966HIGHCVE-2023-1966EPSS 0.9%CVE-2026-48584CRITICALMicrosoft Azure Synapse Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-69464HIGHMicrosoft Office SharePoint Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-59133HIGHMicrosoft High Performance Computing (HPC) Pack Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-41900HIGHOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution EnvironmentEPSS 0.9%