Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2023-31358HIGHA DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inEPSS 0.2%CVE-2023-28966HIGHJunos OS Evolved: Local low-privileged user with shell access can execute CLI commands as rootEPSS 0.2%CVE-2024-2175HIGHAn insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)EPSS 0.2%CVE-2021-46834MEDIUMA permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked EPSS 0.2%CVE-2024-11969HIGHIncorrect default permissions in Cradlepoint NetCloud ExchangeEPSS 0.2%CVE-2025-9190MEDIUMTCC Bypass via misconfigured Node fuses in CursorEPSS 0.2%CVE-2024-42419MEDIUMIncorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potentEPSS 0.2%CVE-2021-41614HIGHAn issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program EPSS 0.2%CVE-2024-42028HIGHA Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and eaEPSS 0.2%CVE-2026-21423MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerabEPSS 0.2%CVE-2026-57895HIGHIncorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installatEPSS 0.2%CVE-2026-69665HIGHSKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attackeEPSS 0.2%CVE-2024-30977HIGHAn issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the passwEPSS 0.2%CVE-2023-25941HIGH Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local attacker could potentiEPSS 0.2%CVE-2026-12823MEDIUMBrowserbase Skills Autobrowse Trace Artifact default permissionEPSS 0.2%CVE-2025-46355HIGHIncorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on WiEPSS 0.2%CVE-2018-25359HIGHSplinterware System Scheduler Pro 5.12 Privilege EscalationEPSS 0.2%CVE-2024-4229HIGHIncorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software forEPSS 0.2%CVE-2025-52991LOWThe Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This aEPSS 0.2%CVE-2024-46463HIGHBy default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perfEPSS 0.2%