Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-25647MEDIUMIncorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticatEPSS 0.1%CVE-2023-28389MEDIUMIncorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentiaEPSS 0.1%CVE-2024-21840HIGHDirectory and File Permission Vulnerability in Hitachi Storage Plug-in for VMware vCenterEPSS 0.1%CVE-2024-22385MEDIUMFile and Directory Permission Vulnerability in Hitachi Storage Provider for VMware vCenterEPSS 0.1%CVE-2026-16247HIGHInsecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAINEPSS 0.1%CVE-2023-6457MEDIUMFile and Directory Permission Vulnerability in Hitachi Tuning ManagerEPSS 0.1%CVE-2026-49237HIGHLocal Privilege Escalation in Canonical MultipassEPSS 0.1%CVE-2025-24795MEDIUMThe Snowflake Connector for Python uses insecure cache files permissionsEPSS 0.1%CVE-2025-23105HIGHAn issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilegeEPSS 0.1%CVE-2023-2737MEDIUMImproper securing of log directory may allow a denial of serviceEPSS 0.1%CVE-2024-49389HIGHLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before buiEPSS 0.1%CVE-2024-5474MEDIUMA potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2EPSS 0.1%CVE-2026-40952HIGHPrivilge misconfiguration in Secure Access installersEPSS 0.1%CVE-2025-21106MEDIUMDell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could poEPSS 0.1%CVE-2023-32547MEDIUMIncorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to poteEPSS 0.1%CVE-2023-27505MEDIUMIncorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow EPSS 0.1%CVE-2024-27264HIGHIBM Performance Tools for i privilege escalationEPSS 0.1%CVE-2023-31246MEDIUMIncorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially eEPSS 0.1%CVE-2023-32543MEDIUMIncorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation oEPSS 0.1%CVE-2025-12100HIGHMongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.1%