Fallos del tipo CWE-276

980 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2023-42133MEDIUMPAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with EPSS 0.2%CVE-2024-38499HIGHImproper Privilege Management Vulnerability in CA Client Automation 14.5EPSS 0.2%CVE-2024-24828MEDIUMLocal Privilege Escalation in execuatables bundled by pkgEPSS 0.2%CVE-2020-13599LOWSecurity problem with settings and littlefsEPSS 0.2%CVE-2026-87886HIGHLocal privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (LiEPSS 0.2%KEVCVE-2024-35139MEDIUMIBM Security Access Manager Docker information disclosureEPSS 0.2%CVE-2025-3528HIGHMirror-registry: local privilege escalation due to incorrect permissions in mirror-registryEPSS 0.2%CVE-2023-50975HIGHThe TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsREPSS 0.2%CVE-2024-21939HIGHIncorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieEPSS 0.2%CVE-2024-52867HIGHguix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata EPSS 0.2%CVE-2024-22085MEDIUMAn issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable.EPSS 0.2%CVE-2024-9167HIGHUnder specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attackeEPSS 0.2%CVE-2025-24267HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 0.2%CVE-2024-38459HIGHlangchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; thEPSS 0.2%CVE-2025-67813MEDIUMQuest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communicationEPSS 0.2%CVE-2022-31071LOWOctopoller gem published with world-writable filesEPSS 0.2%CVE-2022-45153HIGHsaphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.slsEPSS 0.2%CVE-2024-21938HIGHIncorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directEPSS 0.2%CVE-2022-21204HIGHImproper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escEPSS 0.2%CVE-2023-3112HIGHA vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to eEPSS 0.2%