Fallos del tipo CWE-276

978 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-8496HIGHUnder specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attackEPSS 0.2%CVE-2025-2502HIGHAn improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.EPSS 0.2%CVE-2021-36781MEDIUMparsec: dangerous 777 permissions for /run/parsecEPSS 0.2%CVE-2025-43350LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker may be able to EPSS 0.2%CVE-2022-3431MEDIUMA potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deaEPSS 0.2%CVE-2024-35287MEDIUMA vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated atEPSS 0.2%CVE-2025-42598HIGHMultiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a lEPSS 0.2%CVE-2025-58712MEDIUMAmq: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2022-42464MEDIUMKernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...EPSS 0.2%CVE-2024-1605MEDIUMDLL side-loading in BMC Control-MEPSS 0.2%CVE-2025-29570HIGHAn issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_imaEPSS 0.2%CVE-2026-113951HIGHIf an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetesEPSS 0.2%CVE-2024-3779MEDIUMDenial of Service in ESET products for WindowsEPSS 0.2%CVE-2023-4706HIGH A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user accoEPSS 0.2%CVE-2020-29503MEDIUMDell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentiaEPSS 0.2%CVE-2024-47240MEDIUMDell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can accEPSS 0.2%CVE-2024-2819MEDIUMFile Permission Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.2%CVE-2025-36632HIGHLocal Privilege EscalationEPSS 0.2%CVE-2023-3440HIGHFile and Directory Permission Vulnerability in JP1/Performance ManagementEPSS 0.2%CVE-2021-22817—A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leadinEPSS 0.2%