Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-29083MEDIUMIncorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potEPSS 0.2%CVE-2024-43114HIGHIn JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissionsEPSS 0.2%CVE-2024-40792LOWA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A malicious app may be able to chanEPSS 0.2%CVE-2025-57854MEDIUMOsus-operator: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2025-48505HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged eEPSS 0.2%CVE-2025-2782MEDIUMWatchGuard Terminal Services Agent Local Privilege Escalation via Non-Standard Installation DirectoryEPSS 0.2%CVE-2025-58713MEDIUMRhpam: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2026-6718MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.2%CVE-2026-63425HIGHDuring an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could alloEPSS 0.1%CVE-2025-23297HIGHNVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attacker with local unpriEPSS 0.1%CVE-2026-25931HIGHvscode-spell-checker has a workspace-trust bypass Code ExecutionEPSS 0.1%CVE-2020-36652MEDIUMFile and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops CenterEPSS 0.1%CVE-2023-32492MEDIUM Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. A low-privileged local attacker could potentially exEPSS 0.1%CVE-2026-48790MEDIUMturso-cli persists Turso platform JWT with world-readable (0o644) file permissionsEPSS 0.1%CVE-2026-56301MEDIUMNuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on LinuxEPSS 0.1%CVE-2026-4793HIGHAn incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files EPSS 0.1%CVE-2024-35201MEDIUMIncorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalatioEPSS 0.1%CVE-2021-37000HIGHSome Huawei wearables have a permission management vulnerability.EPSS 0.1%CVE-2024-32861HIGHSoftware House C•CURE - CouchDB executable protectionEPSS 0.1%CVE-2025-61035HIGHThe seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik fileEPSS 0.1%