Fallos del tipo CWE-250

392 resultados

Execução com privilégios desnecessários

É quando um programa ou processo roda com mais permissões do que precisa para executar suas funções normais. Se esse programa for comprometido, o atacante herda todos esses privilégios extras, ampliando drasticamente o dano possível. É o oposto do princípio do menor privilégio.

Ejemplo

Um daemon web que deveria apenas servir arquivos estáticos roda como root ao invés de um usuário específico sem privilégios. Se a aplicação web tiver uma vulnerabilidade de RCE, o invasor já está dentro com acesso total ao sistema, podendo alterar qualquer arquivo ou iniciar ataques laterais.

Cómo mitigar

Implemente o princípio do menor privilégio: crie contas de serviço dedicadas com apenas as permissões necessárias, use drop privileges em runtime quando possível, configure containers e VMs com usuários não-root, e revise regularmente quais recursos cada aplicação realmente precisa acessar.

CVE-2025-33103HIGHIBM i privilege escalationEPSS 0.5%CVE-2019-10147MEDIUMrkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not liEPSS 0.5%CVE-2025-33109HIGHIBM i privilege escalationEPSS 0.4%CVE-2023-42954MEDIUMA privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in toEPSS 0.4%CVE-2024-8266MEDIUMExecution with Unnecessary Privileges in GitLabEPSS 0.4%CVE-2026-34877CRITICALAn issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or sEPSS 0.4%CVE-2025-62503MEDIUMApache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)EPSS 0.4%CVE-2023-31175HIGHExecution with Unnecessary PrivilegesEPSS 0.4%CVE-2025-1137HIGHIBM Storage Scale command injectionEPSS 0.4%CVE-2026-55094HIGHTaskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)EPSS 0.4%CVE-2026-15584HIGHRedhatinsights/incluster-checks: incluster-checks: privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node rootEPSS 0.4%CVE-2026-17445HIGHIBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon []EPSS 0.4%CVE-2025-67510CRITICALMySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)EPSS 0.4%CVE-2025-13506HIGHImproper Authorization in Nebim Neyir's Nebim V3 ERPEPSS 0.4%CVE-2026-87506HIGHPrivilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pEPSS 0.4%CVE-2022-41950MEDIUMPrivilege Escalation Vulnerability by wrong chmod paramEPSS 0.4%CVE-2022-38691HIGHIn BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additionEPSS 0.4%CVE-2026-50737CRITICALWhen applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressionsEPSS 0.4%CVE-2026-102118HIGHKiteworks Core before version 9.5.0 is vulnerable to Local Privilege EscalationEPSS 0.4%CVE-2025-59481HIGHBIG-IP iControl REST and tmsh vulnerabilityEPSS 0.4%