Weaknesses of type CWE-749

174 results

Exposição de método ou função perigosa

Uma função ou método sensível fica acessível quando não deveria estar — seja por falta de controle de acesso, visibilidade errada ou ausência de autenticação. Isso permite que atacantes invoquem operações críticas (deletar dados, alterar configurações, executar código) que deveriam ser restritas.

Example

Uma API REST expõe um endpoint `/admin/reset-db` sem autenticação, permitindo qualquer pessoa deletar toda a base de dados. Ou uma classe Java com método `public` que executa operações administrativas, acessível por classes não autorizadas.

How to mitigate

Implemente controle de acesso explícito: valide permissões antes de executar qualquer operação sensível, use visibilidade apropriada (private/protected), autentique e autorize requisições em todas as entradas perigosas, e siga o princípio do menor privilégio.

CVE-2021-34996HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authEPSS 82.3%CVE-2010-0738MEDIUMThe JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 aEPSS 79.4%KEVCVE-2018-10931CRITICALIt was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker EPSS 67.9%CVE-2010-1428HIGHThe Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09EPSS 62.3%KEVCVE-2023-38124HIGHInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 59.6%CVE-2006-1547HIGHActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service vEPSS 54.6%KEVCVE-2023-27363HIGHFoxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 47.0%CVE-2023-51573CRITICALVoltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass VulnerabilityEPSS 45.7%CVE-2026-22812HIGHOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command ExecutionEPSS 17.0%CVE-2021-28809CRITICALMissing Authentication for Critical Function in RTRR Server in HBS3EPSS 15.8%CVE-2023-49074HIGHA denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.EPSS 13.5%CVE-2020-15623CRITICALThis vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthentEPSS 8.3%CVE-2020-17388HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 7.5%CVE-2021-42128—An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via EEPSS 4.5%CVE-2014-5415CRITICALBeckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or FunctionEPSS 4.3%CVE-2021-26614HIGHIpTime C200 IP camera remote code execution vulnerabilityEPSS 2.5%CVE-2016-9469—Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequesEPSS 2.4%CVE-2023-44414CRITICALD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.4%CVE-2025-26651MEDIUMWindows Local Session Manager (LSM) Denial of Service VulnerabilityEPSS 2.3%CVE-2023-38097HIGHNETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.1%