Fallos del tipo CWE-264

299 resultados

Controle de acesso e privilégios inadequado

A aplicação não valida ou não implementa corretamente as permissões necessárias para acessar recursos sensíveis, permitindo que usuários realizem operações além do seu nível de privilégio autorizado. Isso pode expor dados confidenciais, modificar informações críticas ou comprometer a integridade do sistema.

Ejemplo

Um usuário comum consegue acessar diretamente uma rota administrativa (/admin/users) porque o backend não verifica se ele é administrador antes de executar a ação, apenas confiando que não tentaria; ou um processo de aplicação roda como root quando precisaria rodar como usuário não-privilegiado, ampliando o impacto de qualquer falha.

Cómo mitigar

Implemente validação de privilégios em todas as operações sensíveis (verificar permissões no servidor, nunca só no cliente), use princípio do menor privilégio (processos e contas com permissões mínimas necessárias), e mantenha matriz de controle de acesso (RBAC ou ABAC) consistente e auditada.

CVE-2018-11461—A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versEPSS 0.4%CVE-2019-13014—Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the prEPSS 0.4%CVE-2019-1682HIGHCisco Application Policy Infrastructure Controller Privilege Escalation VulnerabilityEPSS 0.4%CVE-2017-12351—A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packEPSS 0.3%CVE-2023-39394—Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list toEPSS 0.3%CVE-2018-0092—A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attackeEPSS 0.3%CVE-2020-8484HIGHABB System 800xA Inter process communication vulnerability - 800xA for DCIEPSS 0.3%CVE-2020-8485HIGHABB System 800xA Inter process communication vulnerability - 800xA for Mod 300EPSS 0.3%CVE-2020-8489HIGHABB System 800xA Inter process communication vulnerability - 800xA Information ManagementEPSS 0.3%CVE-2020-8478MEDIUMABB System 800xA Inter process communication vulnerabilityEPSS 0.3%CVE-2021-1258MEDIUMCisco AnyConnect Secure Mobility Client Arbitrary File Read VulnerabilityEPSS 0.3%CVE-2020-3379MEDIUMCisco SD-WAN Solution Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2021-27851—Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'EPSS 0.3%CVE-2019-1596HIGHCisco NX-OS Software Bash Shell Privilege Escalation VulnerabilityEPSS 0.3%CVE-2017-3801—A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitEPSS 0.3%CVE-2026-6878MEDIUMByteDance verl grader.py math_equal sandboxEPSS 0.3%CVE-2020-3115HIGHCisco SD-WAN Solution Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2020-8487MEDIUMABB System 800xA Inter process communication vulnerability - System 800xA BaseEPSS 0.3%CVE-2020-8486MEDIUMABB System 800xA Inter process communication vulnerability - 800xA RNRPEPSS 0.3%CVE-2022-48508— Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.EPSS 0.3%