Fallos del tipo CWE-250

399 resultados

Execução com privilégios desnecessários

É quando um programa ou processo roda com mais permissões do que precisa para executar suas funções normais. Se esse programa for comprometido, o atacante herda todos esses privilégios extras, ampliando drasticamente o dano possível. É o oposto do princípio do menor privilégio.

Ejemplo

Um daemon web que deveria apenas servir arquivos estáticos roda como root ao invés de um usuário específico sem privilégios. Se a aplicação web tiver uma vulnerabilidade de RCE, o invasor já está dentro com acesso total ao sistema, podendo alterar qualquer arquivo ou iniciar ataques laterais.

Cómo mitigar

Implemente o princípio do menor privilégio: crie contas de serviço dedicadas com apenas as permissões necessárias, use drop privileges em runtime quando possível, configure containers e VMs com usuários não-root, e revise regularmente quais recursos cada aplicação realmente precisa acessar.

CVE-2025-36356CRITICALIBM Security Verify Access privilege escalationEPSS 0.2%CVE-2023-38641HIGHA vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). The affected application's database service is executed as EPSS 0.2%CVE-2025-3364MEDIUMHGiga PowerStation - Chroot EscapeEPSS 0.2%CVE-2026-80238CRITICALDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with UnEPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%CVE-2026-75092HIGHLeapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable pluginsEPSS 0.2%CVE-2025-20185LOWCisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-22890MEDIUMExecution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specEPSS 0.2%CVE-2025-8907HIGHH3C M2 NAS Webserver Configuration unnecessary privilegesEPSS 0.2%CVE-2020-26074HIGHCisco SD-WAN vManage Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-15226HIGHsnapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp TemplatesEPSS 0.2%CVE-2026-104795HIGHInsights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary executionEPSS 0.2%CVE-2024-49804HIGHIBM Security Verify Access Appliance privilege escalationEPSS 0.2%CVE-2026-20017MEDIUMCisco Secure FTD Software Authenticated Command Injection VulnerabilityEPSS 0.2%CVE-2023-34118HIGHImproper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of priEPSS 0.2%CVE-2024-12673HIGHAn improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allowEPSS 0.2%CVE-2025-58432MEDIUMZimaOS Privilege Escalation using localhost calls to File API UploadEPSS 0.2%CVE-2026-24183HIGHNVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege manaEPSS 0.2%CVE-2026-8933HIGHsnap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment SetupEPSS 0.2%CVE-2025-1411HIGHIBM Security Verify Directory Container command executionEPSS 0.2%