Fallos del tipo CWE-267

77 resultados

Privilégio Definido com Ações Inseguras

Quando um sistema concede privilégios elevados a um usuário ou processo, mas não restringe adequadamente quais ações podem ser executadas com esses privilégios. O atacante consegue executar operações perigosas (leitura/escrita de arquivos críticos, modificação de configurações do sistema, etc.) aproveitando o acesso amplo e mal definido.

Ejemplo

Um aplicativo web executa tarefas administrativas em nome de usuários. Se a lógica de autorização apenas verifica 'é admin?' mas não valida 'um admin pode deletar usuários de produção a partir dessa rota?', um atacante autenticado como admin consegue executar ações não intencionais e destrutivas.

Cómo mitigar

Implemente controle de acesso baseado em roles específicas e granulares (RBAC ou ABAC), validando não apenas quem é o usuário, mas que ações concretas aquela função está autorizada a fazer em cada contexto. Revise regularmente as permissões atribuídas e registre (log) todas as operações privilegiadas.

CVE-2025-62289MEDIUMVulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is afEPSS 0.3%CVE-2025-62288MEDIUMVulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Logger). SEPSS 0.3%CVE-2026-23526HIGHCVAT vulnerable to privilege escalation of users with staff statusEPSS 0.3%CVE-2025-62479LOWVulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is EPSS 0.3%CVE-2025-62480LOWVulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that EPSS 0.3%CVE-2017-2616MEDIUMA race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attackEPSS 0.3%CVE-2026-27314HIGHApache Cassandra: Privilege escalation via ADD IDENTITY authorization bypassEPSS 0.3%CVE-2024-7571HIGHIncorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.EPSS 0.3%CVE-2026-96367MEDIUMWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162EPSS 0.3%CVE-2026-0945MEDIUMRole Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002EPSS 0.2%CVE-2026-96363LOWWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161EPSS 0.2%CVE-2024-39866HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to uploEPSS 0.2%CVE-2026-96371MEDIUMWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166EPSS 0.2%CVE-2024-47906HIGHExcessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before versiEPSS 0.2%CVE-2024-8539HIGHImproper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configEPSS 0.2%CVE-2023-44218HIGH A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windows operating system EPSS 0.2%CVE-2024-9842HIGHIncorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary foldersEPSS 0.2%CVE-2025-62588HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.EPSS 0.2%CVE-2026-96390MEDIUMEditoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185EPSS 0.2%CVE-2025-62589HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.EPSS 0.2%