Fallos del tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

A aplicação não valida ou não implementa corretamente as permissões necessárias para acessar recursos sensíveis, permitindo que usuários realizem operações além do seu nível de privilégio autorizado. Isso pode expor dados confidenciais, modificar informações críticas ou comprometer a integridade do sistema.

Ejemplo

Um usuário comum consegue acessar diretamente uma rota administrativa (/admin/users) porque o backend não verifica se ele é administrador antes de executar a ação, apenas confiando que não tentaria; ou um processo de aplicação roda como root quando precisaria rodar como usuário não-privilegiado, ampliando o impacto de qualquer falha.

Cómo mitigar

Implemente validação de privilégios em todas as operações sensíveis (verificar permissões no servidor, nunca só no cliente), use princípio do menor privilégio (processos e contas com permissões mínimas necessárias), e mantenha matriz de controle de acesso (RBAC ou ABAC) consistente e auditada.

CVE-2020-8487MEDIUMABB System 800xA Inter process communication vulnerability - System 800xA BaseEPSS 0.3%CVE-2020-8486MEDIUMABB System 800xA Inter process communication vulnerability - 800xA RNRPEPSS 0.3%CVE-2022-48508— Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.EPSS 0.3%CVE-2020-1619MEDIUMJunos OS: QFX10K Series, EX9200 Series, MX Series, PTX Series: Privilege escalation vulnerability in NG-RE.EPSS 0.3%CVE-2017-12261—A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated,EPSS 0.3%CVE-2020-3208MEDIUMCisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Image Verification Bypass VulnerabilityEPSS 0.3%CVE-2017-6623—A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the CPS appliance couldEPSS 0.3%CVE-2019-1803HIGHCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Root Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-96012CRITICALIBM Db2 Mirror for i Privilege EscalationEPSS 0.3%CVE-2019-13013—Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helperEPSS 0.3%CVE-2020-7254HIGHPrivilege escalation in Advanced Threat DefenseEPSS 0.3%CVE-2026-6224MEDIUMnocobase plugin-workflow-javascript Vm.js createSafeConsole sandboxEPSS 0.3%CVE-2023-39387—Vulnerability of permission control in the window management module. Successful exploitation of this vulnerability may cause malicious pop-uEPSS 0.3%CVE-2026-116367MEDIUMDeepSeek Harness sandbox.ts createContextEPSS 0.3%CVE-2023-42005HIGHIBM Db2 on Cloud Pak for Data privilege escalationEPSS 0.3%CVE-2026-76488MEDIUMCisco Application Policy Infrastructure Controller Authenticated Information Disclosure VulnerabilityEPSS 0.3%CVE-2019-3637MEDIUMPrivilege Escalation vulnerability in FRP 5.x earlier than 5.1.0.209EPSS 0.3%CVE-2020-3180HIGHCisco SD-WAN Solution Software Static Credentials VulnerabilityEPSS 0.3%CVE-2020-3530HIGHCisco IOS XR Authenticated User Privilege Escalation VulnerabilityEPSS 0.3%CVE-2023-52106MEDIUMVulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability EPSS 0.3%