Fallos del tipo CWE-269

2509 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2023-21272—In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation EPSS 0.2%CVE-2022-35257HIGHA local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local acceEPSS 0.2%CVE-2025-36630HIGHLocal Privilege EscalationEPSS 0.2%CVE-2024-29210LOWA local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its configEPSS 0.2%CVE-2022-21827—An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 wEPSS 0.2%CVE-2023-44217HIGH A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local loEPSS 0.2%CVE-2024-38830HIGHLocal privilege escalation vulnerabilityEPSS 0.2%CVE-2026-21882HIGHtheshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-executionEPSS 0.2%CVE-2023-45320MEDIUMUncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potenEPSS 0.2%CVE-2024-6326LOWRockwell Automation Unsecured Private Keys in FactoryTalk® System ServicesEPSS 0.2%CVE-2024-7890MEDIUMLocal privilege escalation allows a low-privileged user to gain SYSTEM privilegesEPSS 0.2%CVE-2025-58432MEDIUMZimaOS Privilege Escalation using localhost calls to File API UploadEPSS 0.2%CVE-2022-34438MEDIUMDell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. A local authenticated malicious user with high pEPSS 0.2%CVE-2023-3160HIGHLocal privilege escalation in security products for WindowsEPSS 0.2%CVE-2024-33393MEDIUMAn issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the toEPSS 0.2%CVE-2025-46310MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26EPSS 0.2%CVE-2026-12313MEDIUMInformation disclosure, sandbox escape in the Security: Process Sandboxing componentEPSS 0.2%CVE-2025-33187CRITICALNVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areasEPSS 0.2%CVE-2026-16997HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.2%CVE-2022-36833HIGHImproper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 EPSS 0.2%