Fallos del tipo CWE-269

2510 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2026-83598HIGHNetdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI RepairEPSS 0.2%CVE-2026-0063CRITICALIn setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the codEPSS 0.2%CVE-2026-75857HIGHCodeWhale before 0.8.64 Privilege Escalation via exec_shell_interactEPSS 0.2%CVE-2025-25230HIGHOmnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is inEPSS 0.2%CVE-2024-44250HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbEPSS 0.2%CVE-2025-24183MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local EPSS 0.2%CVE-2026-60847LOWVulnerability in the Oracle Order Entry product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are afEPSS 0.2%CVE-2026-28840HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS TahoEPSS 0.2%CVE-2023-21458MEDIUMImproper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn offEPSS 0.2%CVE-2026-34218MEDIUMClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modificationEPSS 0.2%CVE-2024-34741HIGHIn setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaEPSS 0.2%CVE-2025-0893HIGHSymantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability.EPSS 0.2%CVE-2024-2431MEDIUMGlobalProtect App: Local User Can Disable GlobalProtectEPSS 0.2%CVE-2022-41835HIGHF5OS vulnerability CVE-2022-41835EPSS 0.2%CVE-2026-31368HIGHPrivilege Bypass in AiAssistantEPSS 0.2%CVE-2025-22231HIGHVMware Aria Operations updates address a local privilege escalation vulnerability (CVE-2025-22231)EPSS 0.2%CVE-2026-15430MEDIUMCVE-2026-15430EPSS 0.2%CVE-2026-34397MEDIUMhimmelblau: NSS fake-primary group lookup reintroduces name collision riskEPSS 0.2%CVE-2023-28758HIGHAn issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NeEPSS 0.2%CVE-2026-28995HIGHA logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOSEPSS 0.2%