Fallos del tipo CWE-250

371 resultados

Execução com privilégios desnecessários

É quando um programa ou processo roda com mais permissões do que precisa para executar suas funções normais. Se esse programa for comprometido, o atacante herda todos esses privilégios extras, ampliando drasticamente o dano possível. É o oposto do princípio do menor privilégio.

Ejemplo

Um daemon web que deveria apenas servir arquivos estáticos roda como root ao invés de um usuário específico sem privilégios. Se a aplicação web tiver uma vulnerabilidade de RCE, o invasor já está dentro com acesso total ao sistema, podendo alterar qualquer arquivo ou iniciar ataques laterais.

Cómo mitigar

Implemente o princípio do menor privilégio: crie contas de serviço dedicadas com apenas as permissões necessárias, use drop privileges em runtime quando possível, configure containers e VMs com usuários não-root, e revise regularmente quais recursos cada aplicação realmente precisa acessar.

CVE-2024-47120MEDIUMIBM Security Verify Information Queue code executionEPSS 0.2%CVE-2026-46748HIGHA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configureEPSS 0.2%CVE-2026-22008LOWVulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to expEPSS 0.2%CVE-2021-0255MEDIUMJunos OS: ethtraceroute Local Privilege Escalation vulnerability in SUID binariesEPSS 0.2%CVE-2025-58431MEDIUMZimaOS reads arbitrary files using localhost calls to File API DownloadEPSS 0.2%CVE-2022-38695HIGHIn BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privilEPSS 0.2%CVE-2023-20210MEDIUMA vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected devicEPSS 0.2%CVE-2024-48837HIGHDell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulneEPSS 0.2%CVE-2022-3088HIGHUC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v EPSS 0.2%CVE-2022-30695—Local privilege escalation due to excessive permissions assigned to child processesEPSS 0.2%CVE-2024-8781HIGHContainer Escape Vulnerability in TR7's Application Security Platform (ASP)EPSS 0.2%CVE-2025-36356CRITICALIBM Security Verify Access privilege escalationEPSS 0.2%CVE-2026-83534MEDIUMPostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()EPSS 0.2%CVE-2023-38641HIGHA vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). The affected application's database service is executed as EPSS 0.2%CVE-2026-55225HIGHStrimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`EPSS 0.2%CVE-2022-41290HIGHIBM AIX privilege escalationEPSS 0.2%CVE-2025-3364MEDIUMHGiga PowerStation - Chroot EscapeEPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%CVE-2025-3925HIGHBrightSign Players Execution with Unnecessary PrivilegesEPSS 0.2%CVE-2025-20185LOWCisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Privilege Escalation VulnerabilityEPSS 0.2%