Weaknesses of type CWE-274

42 results

Escalonamento de Privilégio

É quando um atacante consegue obter permissões superiores às que deveria ter no sistema — passando de usuário comum para administrador, ou de visitante para proprietário de dados. Isso acontece porque a aplicação não valida corretamente se o usuário realmente tem direito àquela ação antes de executá-la.

Example

Um portal bancário permite que qualquer usuário logado acesse a URL '/admin/relatorio?usuario=123' sem verificar se ele é administrador. Um cliente normal descobre isso, muda o parâmetro para outro usuário e acessa dados confidenciais ou altera configurações que não deveria.

How to mitigate

Implemente verificação de autorização em cada operação sensível (não confie só na URL ou no frontend): sempre valide se o usuário logado tem o papel/permissão necessária no servidor antes de executar a ação. Use listas de controle de acesso (ACL) ou políticas de segurança bem definidas no código.

CVE-2024-0105HIGHNVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A succeEPSS 0.3%CVE-2020-7264HIGHPrivilege Escalation vulnerability through symbolic links in ENS for WindowsEPSS 0.3%CVE-2020-7265HIGHPrivilege Escalation vulnerability through symbolic links in ENSMEPSS 0.3%CVE-2020-7267HIGHPrivilege Escalation vulnerability through symbolic links in VSELEPSS 0.3%CVE-2020-7266HIGHPrivilege Escalation vulnerability through symbolic links in VSE for WindowsEPSS 0.3%CVE-2020-7286HIGHPrivilege Escalation vulnerability in EDR for WindowsEPSS 0.3%CVE-2020-7285HIGHPrivilege Escalation vulnerability in MVISION EndpointEPSS 0.3%CVE-2020-7290HIGHPrivilege Escalation vulnerability in MAR for LinuxEPSS 0.3%CVE-2020-7287HIGHPrivilege Escalation vulnerability in EDR for LinuxEPSS 0.3%CVE-2020-7288HIGHPrivilege Escalation vulnerability in EDR for MacEPSS 0.3%CVE-2020-7291HIGHPrivilege Escalation vulnerability MAR for MacEPSS 0.3%CVE-2025-62175MEDIUMMastodon streaming API fails to disconnect disabled and suspended usersEPSS 0.2%CVE-2025-54511MEDIUMImproper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a functiEPSS 0.2%CVE-2025-31275MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able tEPSS 0.2%CVE-2018-6693MEDIUMEndpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerabilityEPSS 0.2%CVE-2023-20516LOWImproper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potentEPSS 0.2%CVE-2018-6674MEDIUMPrivilege escalation vulnerability in McAfee VSE when McTray run with elevated privilegesEPSS 0.2%CVE-2023-32494MEDIUM Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. A local privileged attacker coEPSS 0.2%CVE-2024-0106HIGHNVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper EPSS 0.2%CVE-2025-20177MEDIUMCisco IOS XR Software Image Verification Bypass VulnerabilityEPSS 0.2%