Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2026-53870MEDIUMHermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store FilesEPSS 0.1%CVE-2026-63425HIGHDuring an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could alloEPSS 0.1%CVE-2025-61667HIGHDatadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissionsEPSS 0.1%CVE-2025-48512HIGHIncorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attackEPSS 0.1%CVE-2026-28727HIGHLocal privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) beEPSS 0.1%CVE-2024-58050MEDIUMVulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.1%CVE-2026-0432HIGHIncorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalatiEPSS 0.1%CVE-2025-1789MEDIUMLocal privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this vulnerability to gaiEPSS 0.1%CVE-2026-28267MEDIUMMultiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwritten in the system diEPSS 0.1%CVE-2026-44469HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%CVE-2025-27711MEDIUMIncorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User AppEPSS 0.1%CVE-2026-48790MEDIUMturso-cli persists Turso platform JWT with world-readable (0o644) file permissionsEPSS 0.1%CVE-2025-8421MEDIUMAn improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could aEPSS 0.1%CVE-2026-0705MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before bEPSS 0.1%CVE-2025-61970HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary codEPSS 0.1%CVE-2024-43081HIGHIn installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the codEPSS 0.1%CVE-2026-21074HIGHIncorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.EPSS 0.1%CVE-2025-69604HIGHAn issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary pEPSS 0.1%CVE-2026-0539HIGHLocal Privilege Escalation in pcvisit service clientEPSS 0.1%CVE-2026-21765HIGHHCL BigFix Platform is affected by insecure permissions on private cryptographic keysEPSS 0.1%