Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2026-78553HIGHInsecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLookEPSS 0.1%CVE-2025-12100HIGHMongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2025-7024MEDIUMLocal privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)EPSS 0.1%CVE-2024-22378MEDIUMIncorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allowEPSS 0.1%CVE-2024-28954MEDIUMIncorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation EPSS 0.1%CVE-2024-47550MEDIUMIncorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escalEPSS 0.1%CVE-2025-20095MEDIUMIncorrect Default Permissions for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentiallyEPSS 0.1%CVE-2025-54059MEDIUMmelange creates SBOM files in APKs with world-writable permissionsEPSS 0.1%CVE-2024-23974MEDIUMIncorrect default permissions in some Intel(R) ISH software installers may allow an authenticated user to potentially enable escalation of pEPSS 0.1%CVE-2023-43747MEDIUMIncorrect default permissions for some Intel(R) Connectivity Performance Suite software installers before version 2.0 may allow an authenticEPSS 0.1%CVE-2025-11575HIGHMongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2023-30902—A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionEPSS 0.1%CVE-2025-13130HIGHRadarr Service Radarr.Console.exe default permissionEPSS 0.1%CVE-2023-29244MEDIUMIncorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software insEPSS 0.1%CVE-2024-23495MEDIUMIncorrect default permissions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to poteEPSS 0.1%CVE-2022-20475HIGHIn test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused depEPSS 0.1%CVE-2025-53813MEDIUMTCC Bypass via misconfigured Node fuses in NozbeEPSS 0.1%CVE-2025-53811MEDIUMTCC Bypass via misconfigured Node fuses in Mosh-ProEPSS 0.1%CVE-2025-13131HIGHSonarr Service Sonarr.Console.exe default permissionEPSS 0.1%CVE-2024-13972HIGHA vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a loEPSS 0.1%