Weaknesses of type CWE-749

217 results

Exposição de método ou função perigosa

Uma função ou método sensível fica acessível quando não deveria estar — seja por falta de controle de acesso, visibilidade errada ou ausência de autenticação. Isso permite que atacantes invoquem operações críticas (deletar dados, alterar configurações, executar código) que deveriam ser restritas.

Example

Uma API REST expõe um endpoint `/admin/reset-db` sem autenticação, permitindo qualquer pessoa deletar toda a base de dados. Ou uma classe Java com método `public` que executa operações administrativas, acessível por classes não autorizadas.

How to mitigate

Implemente controle de acesso explícito: valide permissões antes de executar qualquer operação sensível, use visibilidade apropriada (private/protected), autentique e autorize requisições em todas as entradas perigosas, e siga o princípio do menor privilégio.

CVE-2020-27123MEDIUMCisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read VulnerabilityEPSS 0.3%CVE-2024-51992MEDIUMMethod Exposure Vulnerability in Modals in orchid/platformEPSS 0.3%CVE-2026-108897MEDIUMSmart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routineEPSS 0.3%CVE-2025-43003MEDIUMInformation Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)EPSS 0.3%CVE-2025-59788MEDIUMCross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0EPSS 0.3%CVE-2020-3513MEDIUMCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesEPSS 0.3%CVE-2020-10268—RVD#2550: Terminate Critical Services in KUKA controller KR C4EPSS 0.3%CVE-2020-3416MEDIUMCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesEPSS 0.3%CVE-2024-35209MEDIUMA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowinEPSS 0.3%CVE-2023-37330HIGHKofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-12060MEDIUMHepta Platforms｜Heptabase - Exposed DangerousEPSS 0.3%CVE-2026-54702HIGHMarkdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message HandlerEPSS 0.3%CVE-2023-51577HIGHVoltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-70387HIGHOnePlus OxygenOS exposed dangerous method vulnerabilityEPSS 0.3%CVE-2026-33584MEDIUMArqit SKA-Platform Enables Access to Debug InformationEPSS 0.3%CVE-2026-6402MEDIUMwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originsEPSS 0.3%CVE-2026-49993MEDIUM@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)EPSS 0.3%CVE-2025-24359HIGHASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox EscapeEPSS 0.3%CVE-2026-44798HIGHNautobot: GitRepository.current_head field should not be writable through REST APIEPSS 0.3%CVE-2024-27261MEDIUMIBM Storage Defender - Resiliency Service privilege escalationEPSS 0.3%