Fallos del tipo CWE-276

952 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2025-15339MEDIUMTanium addressed an incorrect default permissions vulnerability in Discover.EPSS 0.3%CVE-2025-15336MEDIUMTanium addressed an incorrect default permissions vulnerability in Performance.EPSS 0.3%CVE-2024-49504HIGHgrub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted ImagesEPSS 0.3%CVE-2022-29483HIGHe-Design - Multiple vulnerabilitiesEPSS 0.3%CVE-2026-59119HIGHPowerShell Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-1488HIGHUnbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalationEPSS 0.3%CVE-2026-39875HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS TahoEPSS 0.3%CVE-2021-3981—A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non priviEPSS 0.3%CVE-2023-52379HIGHPermission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiaEPSS 0.3%CVE-2021-31998MEDIUMinn: %post calls user owned file allowing local privilege escalation to rootEPSS 0.3%CVE-2025-15343MEDIUMTanium addressed an incorrect default permissions vulnerability in Enforce.EPSS 0.3%CVE-2025-15341MEDIUMTanium addressed an incorrect default permissions vulnerability in Benchmark.EPSS 0.3%CVE-2025-15340MEDIUMTanium addressed an incorrect default permissions vulnerability in Comply.EPSS 0.3%CVE-2024-36063HIGHThe Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to placeEPSS 0.3%CVE-2021-47852HIGHRockstar Service - Insecure File PermissionsEPSS 0.3%CVE-2018-9467CRITICALIn the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect secuEPSS 0.3%CVE-2020-8903HIGHPriviged Escalation in Google Cloud Platform's Guest-OSLoginEPSS 0.3%CVE-2022-2735—A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communicatioEPSS 0.3%CVE-2021-21911HIGHA privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2EPSS 0.3%CVE-2021-21910HIGHA privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2EPSS 0.3%