Fallos del tipo CWE-276

978 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2022-44554HIGHThe power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of EPSS 0.5%CVE-2024-44760CRITICALIncorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allowEPSS 0.5%CVE-2025-15615MEDIUMWazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of ServiceEPSS 0.5%CVE-2022-0997LOWLocal Privilege Escalation Vulnerability in Fidelis Network and DeceptionEPSS 0.5%CVE-2022-37003MEDIUMThe AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation aEPSS 0.5%CVE-2024-44786HIGHIncorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.EPSS 0.5%CVE-2023-37878MEDIUMInsecure Default Permissions in Wing FTP Server <= 7.2.0EPSS 0.5%CVE-2025-8031CRITICALIncorrect URL stripping in CSP reportsEPSS 0.5%CVE-2023-32999MEDIUMA missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attEPSS 0.5%CVE-2023-23850MEDIUMA missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate EPSS 0.5%CVE-2026-77393HIGHInductive Automation Ignition Incorrect Default PermissionsEPSS 0.5%CVE-2021-36400MEDIUMIn Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.EPSS 0.5%CVE-2020-13555HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationEPSS 0.5%CVE-2020-13552HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationEPSS 0.5%CVE-2020-13553HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationEPSS 0.5%CVE-2025-25535CRITICALHTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request.EPSS 0.5%CVE-2023-29057HIGHA valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to EPSS 0.5%CVE-2025-30701HIGHVulnerability in the RAS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and EPSS 0.5%CVE-2024-27171HIGHInsecure permissionsEPSS 0.5%CVE-2024-53351CRITICALInsecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.EPSS 0.5%