Fallos del tipo CWE-250

399 resultados

Execução com privilégios desnecessários

É quando um programa ou processo roda com mais permissões do que precisa para executar suas funções normais. Se esse programa for comprometido, o atacante herda todos esses privilégios extras, ampliando drasticamente o dano possível. É o oposto do princípio do menor privilégio.

Ejemplo

Um daemon web que deveria apenas servir arquivos estáticos roda como root ao invés de um usuário específico sem privilégios. Se a aplicação web tiver uma vulnerabilidade de RCE, o invasor já está dentro com acesso total ao sistema, podendo alterar qualquer arquivo ou iniciar ataques laterais.

Cómo mitigar

Implemente o princípio do menor privilégio: crie contas de serviço dedicadas com apenas as permissões necessárias, use drop privileges em runtime quando possível, configure containers e VMs com usuários não-root, e revise regularmente quais recursos cada aplicação realmente precisa acessar.

CVE-2026-71846MEDIUMInsights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilegeEPSS 0.2%CVE-2025-8486HIGHA potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges.EPSS 0.2%CVE-2024-32853MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privilegeEPSS 0.2%CVE-2025-58379MEDIUMPassword Exposure in Brocade Fabric OSEPSS 0.2%CVE-2026-14172HIGHRapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable InvocationEPSS 0.2%CVE-2026-12505HIGHCifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcallEPSS 0.2%CVE-2024-31891HIGHIBM Storage Scale privilege escalationEPSS 0.2%CVE-2026-32643HIGHBIG-IP and BIG-IQ privilege escalation vulnerabilityEPSS 0.2%CVE-2025-40942HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege eEPSS 0.2%CVE-2025-62876MEDIUMA Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affeEPSS 0.2%CVE-2025-33120HIGHIBM QRadar SIEM privilege escalationEPSS 0.2%CVE-2026-79942LOWDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with UnEPSS 0.2%CVE-2025-50753HIGHMitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" isEPSS 0.2%CVE-2023-4814HIGH A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for wEPSS 0.2%CVE-2025-3892MEDIUMACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be explEPSS 0.2%CVE-2025-24331MEDIUMNokia Single RAN baseband OAM service extensive capabilitiesEPSS 0.2%CVE-2023-32486MEDIUM Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit EPSS 0.2%CVE-2026-21426MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges EPSS 0.2%CVE-2026-3623HIGHVulnerabilities exists in IBM Netezza Performance Server Replication ServicesEPSS 0.2%CVE-2025-21110MEDIUMDell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker EPSS 0.1%