Fallos del tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-43081HIGHIn installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the codEPSS 0.1%CVE-2026-107573HIGHIncorrect Default Permissions in hMailServerEPSS 0.1%CVE-2026-107571HIGHIncorrect Default Permissions in hMailServerEPSS 0.1%CVE-2026-0539HIGHLocal Privilege Escalation in pcvisit service clientEPSS 0.1%CVE-2026-123505MEDIUMVikunja before 2.7.1 World-Readable Local File Storage and SQLite DatabaseEPSS 0.1%CVE-2026-24414MEDIUMIcinga for Windows certificate can have too-open permissionsEPSS 0.1%CVE-2022-25814MEDIUMPendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthEPSS 0.1%CVE-2023-21129—In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch while the app is in the bEPSS 0.1%CVE-2024-31312MEDIUMIn multiple locations, there is a possible information leak due to a missing permission check. This could lead to local information disclosuEPSS 0.1%CVE-2022-25815MEDIUMPendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized EPSS 0.1%CVE-2022-30758MEDIUMImplicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected informatioEPSS 0.1%CVE-2025-36522MEDIUMIncorrect default permissions for some Intel(R) Chipset Software before version 10.1.20266.8668 or later. within Ring 3: User Applications mEPSS 0.1%CVE-2025-31655MEDIUMIncorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of priEPSS 0.1%CVE-2024-43089HIGHIn updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could leEPSS 0.1%CVE-2018-9434HIGHIn multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could lead to local escalatiEPSS 0.1%CVE-2024-20005HIGHIn da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with SystemEPSS 0.1%CVE-2024-40661HIGHIn mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permisEPSS 0.1%CVE-2022-20611HIGHIn deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions bEPSS 0.1%CVE-2018-9401HIGHIn many locations, there is a possible way to access kernel memory in user space due to an incorrect bounds check. This could lead to local EPSS 0.1%CVE-2024-43086MEDIUMIn validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to aEPSS 0.1%