Weaknesses of type CWE-276

952 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2022-45562HIGHInsecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdooEPSS 1.0%CVE-2023-27195CRITICALTrimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration EPSS 1.0%CVE-2023-33282CRITICALMarval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valEPSS 1.0%CVE-2020-5353HIGHThe Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (EPSS 1.0%CVE-2023-31468HIGHAn issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder EPSS 1.0%CVE-2020-10279CRITICALRVD#2569: Insecure operating system defaults in MiR robotsEPSS 1.0%CVE-2023-33745—TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection,EPSS 1.0%CVE-2021-41166MEDIUMPermission bypass in Nextcloud Android AppEPSS 0.9%CVE-2023-23566CRITICALA 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to aEPSS 0.9%CVE-2023-29732CRITICALSoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The aEPSS 0.9%CVE-2023-32407—A logic issue was addressed with improved state management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 anEPSS 0.9%CVE-2024-20671MEDIUMMicrosoft Defender Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2025-24172CRITICALA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOEPSS 0.9%CVE-2024-21012LOWVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: NetworkEPSS 0.9%CVE-2025-24195CRITICALAn integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VentEPSS 0.9%CVE-2017-3210—Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code executionEPSS 0.9%CVE-2022-3368HIGHSoftware Updater of Avira Security for Windows vulnerable to Privilege EscalationEPSS 0.9%CVE-2023-33291HIGHIn ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-maiEPSS 0.9%CVE-2020-13534CRITICALA privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, refereEPSS 0.9%CVE-2023-4664HIGHPrivilage Escalation in Saphira ConnectEPSS 0.9%