Fallos del tipo CWE-269

2495 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2026-15215HIGHSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationEPSS 0.6%CVE-2022-31672MEDIUMVMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate EPSS 0.6%CVE-2023-47682HIGHWordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerabilityEPSS 0.6%CVE-2026-73218HIGHCursor: Sandbox escape via launching privileged containersEPSS 0.6%CVE-2025-29165CRITICALAn issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample componentEPSS 0.6%CVE-2023-37058CRITICALInsecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to escalate privileges vEPSS 0.6%CVE-2024-0751HIGHA malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, aEPSS 0.6%CVE-2022-34703HIGHWindows Partition Management Driver Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2023-21848HIGHVulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). TheEPSS 0.6%CVE-2026-2562MEDIUMJingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi cast_streen privileges managementEPSS 0.6%CVE-2026-2561MEDIUMJingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges managementEPSS 0.6%CVE-2026-31070CRITICALThe LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigningEPSS 0.6%CVE-2023-7080HIGHArbitrary remote code execution within wrangler dev Workers sandboxEPSS 0.6%CVE-2023-48171HIGHAn issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.EPSS 0.6%CVE-2022-32840HIGHThis issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app mayEPSS 0.6%CVE-2023-33966HIGHDeno missing "--allow-net" permission check for built-in Node modulesEPSS 0.6%CVE-2026-76678HIGHAuthenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN GatewaysEPSS 0.6%CVE-2024-22752HIGHInsecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executableEPSS 0.6%CVE-2017-20037MEDIUMSICUNET Access Controller privileges managementEPSS 0.6%CVE-2023-28261MEDIUMMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 0.6%