Fallos del tipo CWE-276

978 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2020-13535CRITICALA privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwriteEPSS 0.7%CVE-2022-36803HIGHThe MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissiEPSS 0.7%CVE-2021-4297MEDIUMtrampgeek jobe Restapi.php runs_post Privilege EscalationEPSS 0.7%CVE-2024-12564MEDIUMExposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3EPSS 0.7%CVE-2022-45552—An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive infEPSS 0.7%CVE-2022-46382HIGHRackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure PermissiEPSS 0.7%CVE-2022-42130MEDIUMThe Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3EPSS 0.7%CVE-2025-49144HIGHNotepad++ Privilege Escalation in Installer via Uncontrolled Executable Search PathEPSS 0.7%CVE-2024-34455HIGHBuildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2.EPSS 0.7%CVE-2024-22409HIGHDefault Privileges allow for high level operations for low privileged users in datahubEPSS 0.7%CVE-2024-5967LOWKeycloak: leak of configured ldap bind credentials through the keycloak admin consoleEPSS 0.6%CVE-2021-23166HIGHA sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and wEPSS 0.6%CVE-2021-3187HIGHAn issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges bEPSS 0.6%CVE-2022-47551MEDIUMApiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issuEPSS 0.6%CVE-2025-24891CRITICALDumb Drop has an arbitrary file overwrite and path traversal for root shellEPSS 0.6%CVE-2022-2366MEDIUMIncorrect defaults can cause attackers to bypass rate limitationsEPSS 0.6%CVE-2020-13541CRITICALAn exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directoryEPSS 0.6%CVE-2025-30706HIGHVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.EPSS 0.6%CVE-2024-11088MEDIUMSimple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized ActorEPSS 0.6%CVE-2025-49843LOWconda-smithy Has Incorrect Default File PermissionsEPSS 0.6%