Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2026-44468HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%CVE-2025-41658MEDIUMCODESYS Toolkit Exposes Sensitive Files via Default PermissionsEPSS 0.1%CVE-2025-8485HIGHAn improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevEPSS 0.1%CVE-2026-11931MEDIUMInsecure Permissions on Authentication Token Cache File in Kiro IDEEPSS 0.1%CVE-2025-11567HIGHCWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is nEPSS 0.1%CVE-2025-11535HIGHMongoDB Connector for BI installation MSI leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2026-34450MEDIUMClaude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory ToolEPSS 0.1%CVE-2024-26025MEDIUMIncorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enableEPSS 0.1%CVE-2025-58097MEDIUMThe installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate fEPSS 0.1%CVE-2025-8098HIGHAn improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.EPSS 0.1%CVE-2024-27134HIGHExcessive directory permissions in MLflow leads to local privilege escalation when using spark_udfEPSS 0.1%CVE-2022-20441HIGHIn navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could leEPSS 0.1%CVE-2025-13155HIGHAn improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code withEPSS 0.1%CVE-2025-13193MEDIUMLibvirt: information disclosure via world-readable vm snapshotsEPSS 0.1%CVE-2026-23703HIGHThe installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrativEPSS 0.1%CVE-2025-53398HIGHThe Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,EPSS 0.1%CVE-2024-0034HIGHIn BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This couldEPSS 0.1%CVE-2025-22849MEDIUMIncorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4EPSS 0.1%CVE-2025-12792LOWThe Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor withEPSS 0.1%CVE-2026-81682HIGHopenssl_encrypt before 1.4.9 Insecure File PermissionsEPSS 0.1%