Fallos del tipo CWE-250

372 resultados

Execução com privilégios desnecessários

É quando um programa ou processo roda com mais permissões do que precisa para executar suas funções normais. Se esse programa for comprometido, o atacante herda todos esses privilégios extras, ampliando drasticamente o dano possível. É o oposto do princípio do menor privilégio.

Ejemplo

Um daemon web que deveria apenas servir arquivos estáticos roda como root ao invés de um usuário específico sem privilégios. Se a aplicação web tiver uma vulnerabilidade de RCE, o invasor já está dentro com acesso total ao sistema, podendo alterar qualquer arquivo ou iniciar ataques laterais.

Cómo mitigar

Implemente o princípio do menor privilégio: crie contas de serviço dedicadas com apenas as permissões necessárias, use drop privileges em runtime quando possível, configure containers e VMs com usuários não-root, e revise regularmente quais recursos cada aplicação realmente precisa acessar.

CVE-2023-32486MEDIUM Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit EPSS 0.2%CVE-2026-3623HIGHVulnerabilities exists in IBM Netezza Performance Server Replication ServicesEPSS 0.2%CVE-2025-58379MEDIUMPassword Exposure in Brocade Fabric OSEPSS 0.2%CVE-2023-25521HIGH NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging EPSS 0.1%CVE-2025-3892MEDIUMACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be explEPSS 0.1%CVE-2026-8370HIGHAutomic Automation Agent Unix privilege escalationEPSS 0.1%CVE-2025-62876MEDIUMA Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affeEPSS 0.1%CVE-2026-80238CRITICALDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with UnEPSS 0.1%CVE-2025-24331MEDIUMNokia Single RAN baseband OAM service extensive capabilitiesEPSS 0.1%CVE-2026-67609HIGHTelenia TVox 26.5.3 Privilege Escalation via Insecure sudoers ConfigurationEPSS 0.1%CVE-2025-21110MEDIUMDell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker EPSS 0.1%CVE-2025-46430HIGHDell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the InstEPSS 0.1%CVE-2025-14096HIGHCredential Disclosure vulnerability in Radiometer ProductsEPSS 0.1%CVE-2024-8903MEDIUMLocal active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: AcronisEPSS 0.1%CVE-2025-43990HIGHDell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged EPSS 0.1%CVE-2024-51722MEDIUMVulnerabilities in SecuSUITE Server Components Impact SecuSUITEEPSS 0.1%CVE-2026-25710HIGHThe new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmaEPSS 0.1%CVE-2024-13090HIGHPrivilege escalation in Guardian/CMC before 24.6.0EPSS 0.1%CVE-2025-40767HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs dockEPSS 0.1%CVE-2026-48098HIGHNexTOR IP Changer Unsafely Uses sudo and shell=TrueEPSS 0.1%