Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2025-24795MEDIUMThe Snowflake Connector for Python uses insecure cache files permissionsEPSS 0.1%CVE-2025-2781MEDIUMWatchGuard Mobile VPN with SSL Local Privilege Escalation via Non-Standard Installation DirectoryEPSS 0.1%CVE-2025-46185MEDIUMAn Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storaEPSS 0.1%CVE-2024-49389HIGHLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before buiEPSS 0.1%CVE-2026-32680HIGHThe installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customEPSS 0.1%CVE-2024-5474MEDIUMA potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2EPSS 0.1%CVE-2025-61970HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary codEPSS 0.1%CVE-2025-32091HIGHIncorrect default permissions in some firmware for the Intel(R) Arc(TM) B-series GPUs within Ring 1: Device Drivers may allow an escalation EPSS 0.1%CVE-2025-7024MEDIUMLocal privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)EPSS 0.1%CVE-2025-41658MEDIUMCODESYS Toolkit Exposes Sensitive Files via Default PermissionsEPSS 0.1%CVE-2024-27264HIGHIBM Performance Tools for i privilege escalationEPSS 0.1%CVE-2023-32543MEDIUMIncorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation oEPSS 0.1%CVE-2023-27505MEDIUMIncorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow EPSS 0.1%CVE-2023-31246MEDIUMIncorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially eEPSS 0.1%CVE-2025-21106MEDIUMDell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could poEPSS 0.1%CVE-2023-32547MEDIUMIncorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to poteEPSS 0.1%CVE-2026-58564HIGHDell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with lEPSS 0.1%CVE-2026-40952HIGHPrivilge misconfiguration in Secure Access installersEPSS 0.1%CVE-2026-11813HIGHA potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated usEPSS 0.1%CVE-2026-24063HIGHWorld-writable uninstall script executed as root in Arturia Software CenterEPSS 0.1%