Fallos del tipo CWE-276

980 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-12903HIGHIncorrect default permissions in Biamp Evoko HomeEPSS 0.2%CVE-2022-30747MEDIUMPendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via impliEPSS 0.2%CVE-2025-0886HIGHAn incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escEPSS 0.2%CVE-2023-45896HIGHntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a LiEPSS 0.2%CVE-2026-53657HIGHLima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socketEPSS 0.2%CVE-2024-11872HIGHEpic Games Launcher Incorrect Default Permissions Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2021-3451MEDIUMA denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to bEPSS 0.2%CVE-2024-0245MEDIUMTask Hijacking in hamza417/inureEPSS 0.2%CVE-2024-39544MEDIUMJunos OS Evolved: Low privileged local user able to view NETCONF traceoptions filesEPSS 0.2%CVE-2026-78553HIGHInsecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLookEPSS 0.2%CVE-2024-43791HIGHRequestStore has Incorrect Default PermissionsEPSS 0.2%CVE-2025-5963MEDIUMTCC Bypass via Dylib Injection in PostboxEPSS 0.2%CVE-2022-4569HIGHA local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with loEPSS 0.2%CVE-2023-24460HIGHIncorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially EPSS 0.2%CVE-2023-38410—The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to eleEPSS 0.2%CVE-2022-1038HIGHA potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommEPSS 0.2%CVE-2024-7587HIGHInformation Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32EPSS 0.2%CVE-2021-3722MEDIUMA denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be wEPSS 0.2%CVE-2025-57850MEDIUMCodeready-ws: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2023-35183HIGHSolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation VulnerabilityEPSS 0.2%