Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2025-11535HIGHMongoDB Connector for BI installation MSI leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2025-20023MEDIUMIncorrect default permissions for some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable esEPSS 0.1%CVE-2025-64724MEDIUMArduino IDE for macOS has Insecure File PermissionsEPSS 0.1%CVE-2025-12792LOWThe Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor withEPSS 0.1%CVE-2025-26470MEDIUMIncorrect default permissions for some Intel(R) Distribution for Python software installers before version 2025.1.0 may allow an authenticatEPSS 0.1%CVE-2025-27559MEDIUMIncorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enaEPSS 0.1%CVE-2025-20087MEDIUMIncorrect default permissions for some Intel(R) oneAPI DPC++/C++ Compiler software installers may allow an authenticated user to potentiallyEPSS 0.1%CVE-2025-64723MEDIUMArduino IDE for macOS has TCC Bypass via Dynamic Library InjectionEPSS 0.1%CVE-2026-2026MEDIUMImproper Access Control Allows Denial of ServiceEPSS 0.1%CVE-2024-6476MEDIUMGee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system priviEPSS 0.1%CVE-2025-36511MEDIUMIncorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applications may allow an eEPSS 0.1%CVE-2026-3315MEDIUMLocal Privilege Escalation Due to Writable Executable in Privileged Visionline Service PathEPSS 0.1%CVE-2025-32453MEDIUMIncorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privilEPSS 0.1%CVE-2025-24826MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before buiEPSS 0.1%CVE-2025-36857LOWRapid7 Appspider Broken Access Control VulnerabilityEPSS 0.1%CVE-2026-44468HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%CVE-2026-28267MEDIUMMultiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwritten in the system diEPSS 0.1%CVE-2026-11931MEDIUMInsecure Permissions on Authentication Token Cache File in Kiro IDEEPSS 0.1%CVE-2024-26025MEDIUMIncorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enableEPSS 0.1%CVE-2022-20448MEDIUMIn buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. TEPSS 0.1%