Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2025-24790MEDIUMSnowflake JDBC uses insecure temporary credential cache file permissionsEPSS 0.2%CVE-2025-43350LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker may be able to EPSS 0.2%CVE-2024-0245MEDIUMTask Hijacking in hamza417/inureEPSS 0.2%CVE-2024-47240MEDIUMDell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can accEPSS 0.2%CVE-2022-30747MEDIUMPendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via impliEPSS 0.2%CVE-2021-3722MEDIUMA denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be wEPSS 0.2%CVE-2022-1038HIGHA potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommEPSS 0.2%CVE-2025-57848MEDIUMContainer-native-virtualization: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2022-26855MEDIUMDell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentiEPSS 0.2%CVE-2025-62577HIGHETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to EPSS 0.2%CVE-2021-44470MEDIUMIncorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentiEPSS 0.2%CVE-2023-3440HIGHFile and Directory Permission Vulnerability in JP1/Performance ManagementEPSS 0.2%CVE-2022-27500MEDIUMIncorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enEPSS 0.2%CVE-2023-42774MEDIUMLiteos-A has a incorrect default permissions vulnerabilityEPSS 0.2%CVE-2022-26344HIGHIncorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enEPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%CVE-2024-51440HIGHAn issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component.EPSS 0.2%CVE-2022-4568HIGHA directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.EPSS 0.2%CVE-2024-8037MEDIUMVulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with acEPSS 0.2%CVE-2026-19841LOWTRENDNET TEW-813DRU vsftpd vsftpd.conf default permissionEPSS 0.2%