Weaknesses of type CWE-749

190 results

Exposição de método ou função perigosa

Uma função ou método sensível fica acessível quando não deveria estar — seja por falta de controle de acesso, visibilidade errada ou ausência de autenticação. Isso permite que atacantes invoquem operações críticas (deletar dados, alterar configurações, executar código) que deveriam ser restritas.

Example

Uma API REST expõe um endpoint `/admin/reset-db` sem autenticação, permitindo qualquer pessoa deletar toda a base de dados. Ou uma classe Java com método `public` que executa operações administrativas, acessível por classes não autorizadas.

How to mitigate

Implemente controle de acesso explícito: valide permissões antes de executar qualquer operação sensível, use visibilidade apropriada (private/protected), autentique e autorize requisições em todas as entradas perigosas, e siga o princípio do menor privilégio.

CVE-2020-12927—A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privilEPSS 0.3%CVE-2026-44836MEDIUMview_component: Preview Route Can Dispatch Inherited Helper MethodsEPSS 0.3%CVE-2025-24361MEDIUMOpening a malicious website while running a Nuxt dev server could allow read-only access to codeEPSS 0.3%CVE-2020-27123MEDIUMCisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read VulnerabilityEPSS 0.3%CVE-2018-8868MEDIUMMedtronic MyCareLink Patient Monitor Exposed Dangerous Method or FunctionEPSS 0.3%CVE-2024-51992MEDIUMMethod Exposure Vulnerability in Modals in orchid/platformEPSS 0.3%CVE-2020-10268—RVD#2550: Terminate Critical Services in KUKA controller KR C4EPSS 0.3%CVE-2020-3416MEDIUMCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesEPSS 0.3%CVE-2020-3513MEDIUMCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesEPSS 0.3%CVE-2024-35209MEDIUMA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowinEPSS 0.3%CVE-2023-37330HIGHKofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-12060MEDIUMHepta Platforms｜Heptabase - Exposed DangerousEPSS 0.3%CVE-2025-43003MEDIUMInformation Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)EPSS 0.3%CVE-2023-51577HIGHVoltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-44107HIGHExposed Reboot via ModbusEPSS 0.3%CVE-2026-33584MEDIUMArqit SKA-Platform Enables Access to Debug InformationEPSS 0.3%CVE-2025-59788MEDIUMCross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0EPSS 0.3%CVE-2026-6402MEDIUMwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originsEPSS 0.3%CVE-2026-49993MEDIUM@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)EPSS 0.3%CVE-2026-44798HIGHNautobot: GitRepository.current_head field should not be writable through REST APIEPSS 0.3%