Fallos del tipo CWE-269

2509 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2022-4294HIGHNorton, Avira, Avast and AVG Antivirus for Windows Privilege EscalationEPSS 0.2%CVE-2022-46358HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2026-41489HIGHPi-hole: Local privilege escalation via config-controlled path in root-executed service hooksEPSS 0.2%CVE-2022-46356HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2022-46357HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2025-4681HIGHImproper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affectEPSS 0.2%CVE-2022-46359HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2025-43320HIGHThe issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app may be able to bypasEPSS 0.2%CVE-2024-8424HIGHWatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEMEPSS 0.2%CVE-2025-50674HIGHAn issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowingEPSS 0.2%CVE-2023-27316HIGHPrivilege Escalation Vulnerability in SnapCenterEPSS 0.2%CVE-2026-35272HIGHVulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions EPSS 0.2%CVE-2026-60248CRITICALVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.EPSS 0.2%CVE-2024-0219HIGHPrivilege Elevation via Telerik JustDecompile InstallerEPSS 0.2%CVE-2023-51776HIGHImproper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code.EPSS 0.2%CVE-2024-11467HIGHOmnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of tEPSS 0.2%CVE-2024-21118MEDIUMVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions thatEPSS 0.2%CVE-2026-20607MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS TahoEPSS 0.2%CVE-2024-21813HIGHExposure of resource to wrong sphere in some Intel(R) DTT software installers may allow an authenticated user to potentially enable escalatiEPSS 0.2%CVE-2026-7977MEDIUMInappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass same origin policy via a EPSS 0.2%