Fallos del tipo CWE-284

7967 resultados

Controle de acesso insuficiente ou ausente

A aplicação não valida corretamente quem pode acessar determinado recurso (arquivo, API, função, dados), permitindo que usuários não autorizados façam operações que deveriam estar bloqueadas. É um dos problemas mais comuns em segurança: sem autenticação e autorização robustas, qualquer um consegue fazer o que não deveria.

Ejemplo

Um admin panel acessível via /admin sem login real, ou uma API que retorna dados de qualquer usuário basta mudar um ID na URL sem verificar se você tem permissão. Outro caso: arquivo de configuração com credenciais exposto publicamente porque a aplicação não define permissões de leitura no servidor.

Cómo mitigar

Implemente autenticação forte (sessões, tokens JWT) e autorização em toda operação sensível — verifique explicitamente se o usuário logado tem permissão antes de retornar dados ou executar ações. Use listas de controle de acesso (ACL) ou Role-Based Access Control (RBAC), e nunca confie em IDs de usuário vindos do cliente sem validação server-side.

CVE-2025-22157HIGHThis High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira CoreEPSS 0.7%CVE-2022-32256MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web servicEPSS 0.7%CVE-2021-28507MEDIUMAn issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.EPSS 0.7%CVE-2023-6578HIGHSoftware AG WebMethods access controlEPSS 0.7%CVE-2026-24014CRITICALApache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File WriteEPSS 0.7%CVE-2022-42126MEDIUMThe Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does EPSS 0.7%CVE-2021-34626MEDIUMWP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType functionEPSS 0.7%CVE-2024-36259HIGHImproper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensEPSS 0.7%CVE-2024-29866CRITICALDatalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner canEPSS 0.7%CVE-2023-44031HIGHIncorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitiveEPSS 0.7%CVE-2026-56161CRITICALAzure Logic Apps Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-25251HIGHcode-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.EPSS 0.7%CVE-2025-6161MEDIUMSourceCodester Simple Food Ordering System editproduct.php unrestricted uploadEPSS 0.7%CVE-2021-44460HIGHImproper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to acEPSS 0.7%CVE-2025-5299MEDIUMSourceCodester Client Database Management System user_order_customer_update.php unrestricted uploadEPSS 0.7%CVE-2025-3236MEDIUMTenda FH1202 Web Management Interface VirSerDMZ access controlEPSS 0.7%CVE-2024-37147MEDIUMGLPI allows Authenticated File Upload to Restricted TicketsEPSS 0.7%CVE-2020-8122—A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.EPSS 0.7%CVE-2025-43192CRITICALA configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-drEPSS 0.7%CVE-2022-45431HIGHSome Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access contrEPSS 0.7%