Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2025-57850MEDIUMCodeready-ws: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2026-25203HIGHSamsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: lEPSS 0.2%CVE-2025-0014HIGHIncorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potentialEPSS 0.2%CVE-2026-57919HIGHPBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENEREPSS 0.2%CVE-2024-36339HIGHA DLL hijacking vulnerability in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalation, potentially resulEPSS 0.2%CVE-2024-28862MEDIUMROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.EPSS 0.2%CVE-2024-42188LOWHCL Connections is vulnerable to a broken access control vulnerabilityEPSS 0.2%CVE-2026-12602HIGHIncorrect permissions in ArubaSign by ArubaEPSS 0.2%CVE-2025-54086MEDIUMExcess Permissions in WarehouseEPSS 0.2%CVE-2025-4280MEDIUMTCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.appEPSS 0.2%CVE-2025-0886HIGHAn incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escEPSS 0.2%CVE-2023-43081MEDIUM PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component. AEPSS 0.2%CVE-2024-21960HIGHIncorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilegeEPSS 0.2%CVE-2024-13206HIGHREVE Antivirus reveinstall default permissionEPSS 0.2%CVE-2025-27612MEDIUMLibcontainer is affected by capabilities elevationEPSS 0.2%CVE-2023-42433MEDIUMIncorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to EPSS 0.2%CVE-2026-27680LOWCSS Injection vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.2%CVE-2024-32942MEDIUMIncorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authenticated user to potentEPSS 0.2%CVE-2023-42928HIGHThe issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be able to gain elevated prEPSS 0.2%CVE-2024-4679HIGHFolder Permission Vulnerability in JP1/Extensible SNMP AgentEPSS 0.2%