Fallos del tipo CWE-269

2510 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2024-31757HIGHAn issue in TeraByte Unlimited Image for Windows v.3.64.0.0 and before and fixed in v.4.0.0.0 allows a local attacker to escalate privilegesEPSS 0.1%CVE-2024-27264HIGHIBM Performance Tools for i privilege escalationEPSS 0.1%CVE-2025-66266CRITICALInsecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege EscalationEPSS 0.1%CVE-2026-19449HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-21981MEDIUMVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.EPSS 0.1%CVE-2026-18071HIGHIBM i is Affected By An Improper Management Vulnerability in HTTP Server []EPSS 0.1%CVE-2026-84089HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.1%CVE-2026-14551HIGHLocal Privilege Escalation in servereye client (sensorhub)EPSS 0.1%CVE-2026-16991HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-73740MEDIUMLocal Privilege Escalation in HPE Networking Fabric ComposerEPSS 0.1%CVE-2026-84042HIGHCrun: crun: rootful krun with passt executes container payload as host rootEPSS 0.1%CVE-2026-82893HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.1%CVE-2026-16937HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2024-31756HIGHAn issue in MarvinTest Solutions Hardware Access Driver v.5.0.3.0 and before and fixed in v.5.0.4.0 allows a local attacker to escalate privEPSS 0.1%CVE-2026-16703HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-18101HIGHIBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyEPSS 0.1%CVE-2025-7406HIGHA Sudo Privilege Escalation Vulnerability in Nokia MantaRay NMEPSS 0.1%CVE-2025-67792HIGHAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulateEPSS 0.1%CVE-2026-43657LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be ableEPSS 0.1%CVE-2025-57443MEDIUMFrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that alEPSS 0.1%