Fallos del tipo CWE-732

788 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2020-17402MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). AEPSS 0.5%CVE-2025-8042CRITICALSandboxed iframe could start downloadsEPSS 0.5%CVE-2024-45841MEDIUMIncorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9EPSS 0.5%CVE-2024-3375CRITICALBroken Access Control in Havelsan's DialogueEPSS 0.5%CVE-2023-6506MEDIUMWP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email SendingEPSS 0.5%CVE-2024-29187HIGHWiX based installers are vulnerable to binary hijack when run as SYSTEMEPSS 0.5%CVE-2022-26340MEDIUMOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior EPSS 0.5%CVE-2024-33499CRITICALA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.5%CVE-2023-34437HIGHBaker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical ResourceEPSS 0.5%CVE-2025-49131MEDIUMFastGPT Sandbox Vulnerable to Sandbox BypassEPSS 0.5%CVE-2026-58174MEDIUMHermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on ImportEPSS 0.5%CVE-2026-62194HIGHOpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin InstallEPSS 0.4%CVE-2024-28163MEDIUMInformation Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)EPSS 0.4%CVE-2020-10642—In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could lEPSS 0.4%CVE-2022-40817MEDIUMZammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly abEPSS 0.4%CVE-2025-21325HIGHWindows Secure Kernel Mode Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-28563MEDIUMApache Airflow: DAG authorization bypassEPSS 0.4%CVE-2024-5618CRITICALBroken Access Control in PruvaSoft Informatics' Apinizer Management ConsoleEPSS 0.4%CVE-2026-43721MEDIUMThis issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe EPSS 0.4%CVE-2024-22334MEDIUMIBM UrbanCode Deploy improper privilege controlEPSS 0.4%