Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-4679HIGHFolder Permission Vulnerability in JP1/Extensible SNMP AgentEPSS 0.2%CVE-2022-20495HIGHIn getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic EPSS 0.2%CVE-2024-22428HIGH Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unpriviEPSS 0.2%CVE-2023-38294MEDIUMCertain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsiEPSS 0.2%CVE-2024-21123LOWVulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily EPSS 0.2%CVE-2026-26034HIGHUPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that alloEPSS 0.2%CVE-2025-54866LOWWazuh installation fails to protected authd.pass on WindowsEPSS 0.2%CVE-2024-52783MEDIUMInsecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code viaEPSS 0.2%CVE-2023-28724HIGHNGINX Management Suite vulnerabilityEPSS 0.2%CVE-2024-52926MEDIUMDelinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent.EPSS 0.2%CVE-2023-29162MEDIUMImproper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 maEPSS 0.2%CVE-2022-36439MEDIUMAsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the EPSS 0.2%CVE-2024-27166HIGHInsecure permissionsEPSS 0.2%CVE-2022-42718HIGHIncorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to poteEPSS 0.2%CVE-2025-43442LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.EPSS 0.2%CVE-2022-45853MEDIUMThe privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHIEPSS 0.2%CVE-2022-36438HIGHAsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading to local privilege escalation (this also canEPSS 0.2%CVE-2024-23847MEDIUMIncorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed wEPSS 0.2%CVE-2026-36742MEDIUMHiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. The UART bootloader is accessible when battery is disconnected (hidden/debug mode)EPSS 0.2%CVE-2024-11468HIGHOmnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. SuccesEPSS 0.2%