Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2026-48191LOWWrong Permission Handling in Document Search Article Meta FiltersEPSS 0.1%CVE-2026-48190LOWIncorrect handling of permissions in External Interface Config Item List moduleEPSS 0.1%CVE-2025-13130HIGHRadarr Service Radarr.Console.exe default permissionEPSS 0.1%CVE-2026-21074HIGHIncorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.EPSS 0.1%CVE-2025-15642MEDIUMNetskope Client Service Insufficient Access ControlsEPSS 0.1%CVE-2024-10183MEDIUMArbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege EscalationEPSS 0.1%CVE-2025-24788MEDIUMSnowflake Connector for .NET has weak temporary files permissionsEPSS 0.1%CVE-2024-51764MEDIUMA security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerabiEPSS 0.1%CVE-2023-28389MEDIUMIncorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentiaEPSS 0.1%CVE-2024-21840HIGHDirectory and File Permission Vulnerability in Hitachi Storage Plug-in for VMware vCenterEPSS 0.1%CVE-2026-48722MEDIUMNextflow: Incorrect default permissions in the nextflow auth login commandEPSS 0.1%CVE-2026-16247HIGHInsecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAINEPSS 0.1%CVE-2024-22385MEDIUMFile and Directory Permission Vulnerability in Hitachi Storage Provider for VMware vCenterEPSS 0.1%CVE-2023-6457MEDIUMFile and Directory Permission Vulnerability in Hitachi Tuning ManagerEPSS 0.1%CVE-2026-49237HIGHLocal Privilege Escalation in Canonical MultipassEPSS 0.1%CVE-2025-13131HIGHSonarr Service Sonarr.Console.exe default permissionEPSS 0.1%CVE-2024-28954MEDIUMIncorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation EPSS 0.1%CVE-2025-20095MEDIUMIncorrect Default Permissions for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentiallyEPSS 0.1%CVE-2024-47550MEDIUMIncorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escalEPSS 0.1%CVE-2023-2737MEDIUMImproper securing of log directory may allow a denial of serviceEPSS 0.1%