Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2023-30905—The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege.EPSS 0.2%CVE-2025-12100HIGHMongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.2%CVE-2025-8766MEDIUMNoobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core containerEPSS 0.2%CVE-2024-2175HIGHAn insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)EPSS 0.2%CVE-2024-4763HIGHAn insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) thEPSS 0.2%CVE-2023-28966HIGHJunos OS Evolved: Local low-privileged user with shell access can execute CLI commands as rootEPSS 0.2%CVE-2020-29489MEDIUMDell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentiEPSS 0.2%CVE-2023-31358HIGHA DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inEPSS 0.2%CVE-2021-46834MEDIUMA permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked EPSS 0.2%CVE-2025-9190MEDIUMTCC Bypass via misconfigured Node fuses in CursorEPSS 0.2%CVE-2024-11969HIGHIncorrect default permissions in Cradlepoint NetCloud ExchangeEPSS 0.2%CVE-2021-41614HIGHAn issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program EPSS 0.2%CVE-2024-42028HIGHA Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and eaEPSS 0.2%CVE-2024-42419MEDIUMIncorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potentEPSS 0.2%CVE-2026-21423MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerabEPSS 0.2%CVE-2026-69665HIGHSKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attackeEPSS 0.2%CVE-2026-57895HIGHIncorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installatEPSS 0.2%CVE-2024-30977HIGHAn issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the passwEPSS 0.2%CVE-2026-49237HIGHLocal Privilege Escalation in Canonical MultipassEPSS 0.2%CVE-2023-25941HIGH Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local attacker could potentiEPSS 0.2%