Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2025-57846HIGHMultiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a local authenticated attEPSS 0.2%CVE-2018-25359HIGHSplinterware System Scheduler Pro 5.12 Privilege EscalationEPSS 0.2%CVE-2024-0833HIGHPrivilege Elevation via Telerik Test StudioEPSS 0.2%CVE-2025-27463CRITICALWinPVDrivers: Excessive permissions on user-exposed devicesEPSS 0.2%CVE-2024-46465HIGHBy default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perfEPSS 0.2%CVE-2024-4229HIGHIncorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software forEPSS 0.2%CVE-2025-27464CRITICALWinPVDrivers: Excessive permissions on user-exposed devicesEPSS 0.2%CVE-2025-27462CRITICALWinPVDrivers: Excessive permissions on user-exposed devicesEPSS 0.2%CVE-2024-46466HIGHBy default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by EPSS 0.2%CVE-2024-46467HIGHBy default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them pEPSS 0.2%CVE-2024-46462HIGHBy default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perEPSS 0.2%CVE-2024-46463HIGHBy default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perfEPSS 0.2%CVE-2020-36695MEDIUMFile and Directory Permission Vulnerability in Hitachi Command SuiteEPSS 0.2%CVE-2023-48678MEDIUMSensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, WEPSS 0.2%CVE-2026-78413MEDIUMVelociraptor privilege escalation via SysmonLogForward client monitoring artifactEPSS 0.2%CVE-2023-32221HIGHEaseUS Todo Backup may allow local privilege escalationEPSS 0.2%CVE-2023-31349HIGHIncorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially rEPSS 0.2%CVE-2025-57852MEDIUMOpenshift-ai: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2023-33240HIGHFoxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previousEPSS 0.2%CVE-2026-81682HIGHopenssl_encrypt before 1.4.9 Insecure File PermissionsEPSS 0.2%