Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2025-11567HIGHCWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is nEPSS 0.1%CVE-2025-55111MEDIUMBMC Control-M/Agent insecure default file permissionsEPSS 0.1%CVE-2026-9633HIGHRedundancy Module Configuration Tool - Multiple VulnerabilitiesEPSS 0.1%CVE-2025-10231HIGHN-central Incorrect Default Permissions could lead to Privilege EscalationEPSS 0.1%CVE-2025-53813MEDIUMTCC Bypass via misconfigured Node fuses in NozbeEPSS 0.1%CVE-2025-22849MEDIUMIncorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4EPSS 0.1%CVE-2025-13193MEDIUMLibvirt: information disclosure via world-readable vm snapshotsEPSS 0.1%CVE-2026-115253HIGHWatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log TamperingEPSS 0.1%CVE-2024-27461MEDIUMIncorrect default permissions in software installer for Intel(R) MAS (GUI) may allow an authenticated user to potentially enable denial of sEPSS 0.1%CVE-2026-108503LOWUnauthorized information acquisition vulnerability in ZTE Z80 Ultra productEPSS 0.1%CVE-2025-1699LOWAn incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.EPSS 0.1%CVE-2026-112357HIGHGFI KerioConnect KOFF < 10.0.9p2 Privilege EscalationEPSS 0.1%CVE-2026-108072MEDIUMInsecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege EscalationEPSS 0.1%CVE-2022-20441HIGHIn navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could leEPSS 0.1%CVE-2025-8098HIGHAn improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.EPSS 0.1%CVE-2026-23703HIGHThe installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrativEPSS 0.1%CVE-2024-34012MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before bEPSS 0.1%CVE-2025-32749MEDIUMDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticateEPSS 0.1%CVE-2026-34450MEDIUMClaude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory ToolEPSS 0.1%CVE-2024-25958MEDIUMDell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. A local authenticated EPSS 0.1%