Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-46962HIGHVulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versiEPSS 0.4%CVE-2026-46961HIGHVulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versiEPSS 0.4%CVE-2026-46951HIGHVulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affectEPSS 0.4%CVE-2026-46973HIGHVulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). SupEPSS 0.4%CVE-2026-46942HIGHVulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations). SupEPSS 0.4%CVE-2025-30733MEDIUMVulnerability in the RDBMS Listener component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 anEPSS 0.4%CVE-2026-46937HIGHVulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versEPSS 0.4%CVE-2021-22943—A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network EPSS 0.4%CVE-2025-3222CRITICALSmallworld SWMFS Improper AuthenticationEPSS 0.4%CVE-2026-10281MEDIUMEnderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authenticationEPSS 0.4%CVE-2026-101281MEDIUMTrusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authenticationEPSS 0.4%CVE-2026-8321MEDIUMinkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypassEPSS 0.4%CVE-2026-13690HIGHUsersWP < 1.2.67 - Two-Factor Authentication BypassEPSS 0.4%CVE-2026-46929HIGHVulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affeEPSS 0.4%CVE-2026-46940HIGHVulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affeEPSS 0.4%CVE-2026-116110MEDIUMGiantappMan LiveWallPaper SignalR Hub UploadFile missing authenticationEPSS 0.4%CVE-2026-125087MEDIUMMichael-A-Kuykendall Shimmy Inference API server.rs missing authenticationEPSS 0.4%CVE-2026-75807HIGHSAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate PoisoningEPSS 0.4%CVE-2024-35670MEDIUMWordPress Integrate Google Drive plugin <= 1.3.93 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-25227HIGH[20250402] - Joomla Core - MFA Authentication BypassEPSS 0.4%