Fallos del tipo CWE-250

399 resultados

Execução com privilégios desnecessários

É quando um programa ou processo roda com mais permissões do que precisa para executar suas funções normais. Se esse programa for comprometido, o atacante herda todos esses privilégios extras, ampliando drasticamente o dano possível. É o oposto do princípio do menor privilégio.

Ejemplo

Um daemon web que deveria apenas servir arquivos estáticos roda como root ao invés de um usuário específico sem privilégios. Se a aplicação web tiver uma vulnerabilidade de RCE, o invasor já está dentro com acesso total ao sistema, podendo alterar qualquer arquivo ou iniciar ataques laterais.

Cómo mitigar

Implemente o princípio do menor privilégio: crie contas de serviço dedicadas com apenas as permissões necessárias, use drop privileges em runtime quando possível, configure containers e VMs com usuários não-root, e revise regularmente quais recursos cada aplicação realmente precisa acessar.

CVE-2018-8853—Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. Windows boots byEPSS 0.4%CVE-2026-113342CRITICALPrivilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass webEPSS 0.4%CVE-2023-27312MEDIUMPrivilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere EPSS 0.4%CVE-2025-23008HIGHAn improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker EPSS 0.4%CVE-2024-20420MEDIUMCisco ATA 190 Series Analog Telephone Adapter Firmware Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-36137HIGHIBM Sterling Connect:Direct for UNIX command executionEPSS 0.4%CVE-2021-47700HIGHNagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary DirectoryEPSS 0.4%CVE-2020-10290MEDIUMRVD#1495: Universal Robots URCaps execute with unbounded privilegesEPSS 0.4%CVE-2025-1977HIGHThe NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenEPSS 0.3%CVE-2018-25123HIGHNagios XI < 5.5.7 Privilege Escalation via MRTG Graphing ComponentEPSS 0.3%CVE-2026-46617HIGHFission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap readEPSS 0.3%CVE-2019-10143MEDIUMIt was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who alreadEPSS 0.3%CVE-2023-38042HIGHA local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEMEPSS 0.3%CVE-2026-42088CRITICALOpenC3 COSMOS: Administrative Actions via the Script Runner ToolEPSS 0.3%CVE-2020-36868HIGHNagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh ScriptEPSS 0.3%CVE-2025-42943MEDIUMInformation Disclosure in SAP GUI for WindowsEPSS 0.3%CVE-2026-47190MEDIUMIPAM controller service account granted unnecessary full access to SecretsEPSS 0.3%CVE-2026-10843HIGHCloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on awsEPSS 0.3%CVE-2026-121234CRITICALPrivilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitEPSS 0.3%CVE-2025-37128MEDIUMAuthenticated Arbitrary Process Termination allows potential System Disruption in ECOSEPSS 0.3%