Fallos del tipo CWE-269

2510 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2026-28586LOWIn multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to loEPSS 0.1%CVE-2024-23713HIGHIn migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to impropEPSS 0.1%CVE-2024-34743HIGHIn setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could leaEPSS 0.1%CVE-2025-6182HIGHRoot Certificate InjectionEPSS 0.1%CVE-2024-27233HIGHIn ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to local escalation of EPSS 0.1%CVE-2024-38487HIGHapi-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintendEPSS 0.1%CVE-2024-29784HIGHIn prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escaEPSS 0.1%CVE-2026-11103HIGHInappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level prEPSS 0.1%CVE-2024-27224HIGHIn strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of priviEPSS 0.1%CVE-2026-11276MEDIUMInappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass discEPSS 0.1%CVE-2026-16923HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2024-27210HIGHIn policy_check of fvp.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privEPSS 0.1%CVE-2026-0019HIGHIn SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation oEPSS 0.1%CVE-2024-27222HIGHIn onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due to Intent Redirect GREPSS 0.1%CVE-2024-40657HIGHIn addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused depuEPSS 0.1%CVE-2024-32899HIGHIn gpu_pm_power_off_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a race condition. This could EPSS 0.1%CVE-2024-25990MEDIUMIn pktproc_perftest_gen_rx_packet_sktbuf_mode of link_rx_pktproc.c, there is a possible out of bounds write due to a race condition. This coEPSS 0.1%CVE-2026-0086MEDIUMIn onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could leaEPSS 0.1%CVE-2024-49742HIGHIn onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings dueEPSS 0.1%CVE-2026-0179MEDIUMIn Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege witEPSS 0.1%