Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2022-23453HIGHPotential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromEPSS 0.2%CVE-2023-4088CRITICALMalicious Code Execution Vulnerability in FA Engineering Software ProductsEPSS 0.2%CVE-2026-48935LOWA flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-reaEPSS 0.2%CVE-2024-42188LOWHCL Connections is vulnerable to a broken access control vulnerabilityEPSS 0.2%CVE-2026-94460HIGHIRISPowerscan Insecure default privilege assignment for installation accountEPSS 0.2%CVE-2025-54866LOWWazuh installation fails to protected authd.pass on WindowsEPSS 0.2%CVE-2026-25203HIGHSamsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: lEPSS 0.2%CVE-2023-3116HIGHLiteos-A has a incorrect default permissions vulnerabilityEPSS 0.2%CVE-2024-29962MEDIUMInsecure file permission setting that makes files world-readableEPSS 0.2%CVE-2025-43442LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.EPSS 0.2%CVE-2024-10469MEDIUMCERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.EPSS 0.2%CVE-2025-4280MEDIUMTCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.appEPSS 0.2%CVE-2023-38295HIGHCertain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permissiEPSS 0.2%CVE-2026-16305HIGHCVE-2026-16305EPSS 0.2%CVE-2022-43701HIGHInsecure directory permissions on installer filesEPSS 0.2%CVE-2026-26034HIGHUPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that alloEPSS 0.2%CVE-2026-21423MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerabEPSS 0.2%CVE-2025-29504HIGHInsecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification.EPSS 0.2%CVE-2024-36339HIGHA DLL hijacking vulnerability in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalation, potentially resulEPSS 0.2%CVE-2022-4575MEDIUM A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attackerEPSS 0.2%