Fallos del tipo CWE-276

980 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2026-6823HIGHHKUDS OpenHarness Insecure Default Remote Channel AllowlistEPSS 0.3%CVE-2023-29733—The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data thaEPSS 0.3%CVE-2025-15343MEDIUMTanium addressed an incorrect default permissions vulnerability in Enforce.EPSS 0.3%CVE-2025-15341MEDIUMTanium addressed an incorrect default permissions vulnerability in Benchmark.EPSS 0.3%CVE-2025-15340MEDIUMTanium addressed an incorrect default permissions vulnerability in Comply.EPSS 0.3%CVE-2012-3427MEDIUMJboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissionsEPSS 0.3%CVE-2018-7533—An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration mayEPSS 0.3%CVE-2019-3688MEDIUMsquid: /usr/sbin/pinger packaged with wrong permissionEPSS 0.3%CVE-2025-43519HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS TahoEPSS 0.3%CVE-2025-46803MEDIUMScreen creates by default world-writable PTYsEPSS 0.3%CVE-2022-31244HIGHNokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.EPSS 0.3%CVE-2022-29483HIGHe-Design - Multiple vulnerabilitiesEPSS 0.3%CVE-2024-43430MEDIUMMoodle: lack of access control when using external methods for quiz overridesEPSS 0.3%CVE-2020-7527—Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full accEPSS 0.3%CVE-2024-46544MEDIUMApache Tomcat Connectors: mod_jk: local users can view and modify configurationEPSS 0.3%CVE-2024-34474HIGHClario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM.EPSS 0.3%CVE-2021-21910HIGHA privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2EPSS 0.3%CVE-2017-12699—An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be EPSS 0.3%CVE-2021-21911HIGHA privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2EPSS 0.3%CVE-2021-47852HIGHRockstar Service - Insecure File PermissionsEPSS 0.3%