Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2023-42133MEDIUMPAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with EPSS 0.2%CVE-2020-13599LOWSecurity problem with settings and littlefsEPSS 0.2%CVE-2024-38499HIGHImproper Privilege Management Vulnerability in CA Client Automation 14.5EPSS 0.2%CVE-2025-54990MEDIUMXWiki AdminTools application doesn't set permissions on the AdminTools spaceEPSS 0.2%CVE-2024-35139MEDIUMIBM Security Access Manager Docker information disclosureEPSS 0.2%CVE-2025-68825HIGHHCL Hive is affected by incorrect default permissionsEPSS 0.2%CVE-2021-3917—A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. TEPSS 0.2%CVE-2024-24828MEDIUMLocal Privilege Escalation in execuatables bundled by pkgEPSS 0.2%CVE-2025-15333MEDIUMTanium addressed an information disclosure vulnerability in Threat Response.EPSS 0.2%CVE-2023-50975HIGHThe TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsREPSS 0.2%CVE-2025-32803MEDIUMInsecure file permissions can result in confidential information leakageEPSS 0.2%CVE-2024-21939HIGHIncorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieEPSS 0.2%CVE-2024-52867HIGHguix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata EPSS 0.2%CVE-2024-22085MEDIUMAn issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable.EPSS 0.2%CVE-2024-38459HIGHlangchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; thEPSS 0.2%CVE-2024-9167HIGHUnder specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attackeEPSS 0.2%CVE-2025-67813MEDIUMQuest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communicationEPSS 0.2%CVE-2025-3528HIGHMirror-registry: local privilege escalation due to incorrect permissions in mirror-registryEPSS 0.2%CVE-2022-21204HIGHImproper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escEPSS 0.2%CVE-2022-45153HIGHsaphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.slsEPSS 0.2%