Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-2175HIGHAn insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)EPSS 0.2%CVE-2023-28966HIGHJunos OS Evolved: Local low-privileged user with shell access can execute CLI commands as rootEPSS 0.2%CVE-2023-31359HIGHIncorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inEPSS 0.2%CVE-2024-11969HIGHIncorrect default permissions in Cradlepoint NetCloud ExchangeEPSS 0.2%CVE-2021-46834MEDIUMA permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked EPSS 0.2%CVE-2021-41614HIGHAn issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program EPSS 0.2%CVE-2024-42419MEDIUMIncorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potentEPSS 0.2%CVE-2025-15523MEDIUMTCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.appEPSS 0.2%CVE-2024-42028HIGHA Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and eaEPSS 0.2%CVE-2022-33922HIGHDell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentiaEPSS 0.2%CVE-2024-30977HIGHAn issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the passwEPSS 0.2%CVE-2025-4412MEDIUMTCC Bypass via Dylib Loading in Viscosity.appEPSS 0.2%CVE-2023-5623HIGHPrivilege Escalation EPSS 0.2%CVE-2020-37160HIGHSprintWork 2.3.1 - Local Privilege EscalationEPSS 0.2%CVE-2026-57895HIGHIncorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installatEPSS 0.2%CVE-2026-69665HIGHSKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attackeEPSS 0.2%CVE-2026-53870MEDIUMHermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store FilesEPSS 0.2%CVE-2023-25941HIGH Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local attacker could potentiEPSS 0.2%CVE-2026-12823MEDIUMBrowserbase Skills Autobrowse Trace Artifact default permissionEPSS 0.2%CVE-2025-57846HIGHMultiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a local authenticated attEPSS 0.2%