Fallos del tipo CWE-732

790 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2025-41118CRITICALSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionEPSS 0.4%CVE-2024-54910MEDIUMHasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.EPSS 0.4%CVE-2024-57068HIGHA prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS)EPSS 0.4%CVE-2026-26929MEDIUMApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataEPSS 0.4%CVE-2020-1736LOWA flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destEPSS 0.4%CVE-2023-1939MEDIUMNo access control for the OTP key on OTP entriesEPSS 0.4%CVE-2024-29078HIGHIncorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unautheEPSS 0.4%CVE-2020-15708CRITICALLibvirt Service Arbitrary File Write Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-40804CRITICALA vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a netwoEPSS 0.4%CVE-2025-69426CRITICALRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCEEPSS 0.4%CVE-2025-14988CRITICALIncorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDAEPSS 0.4%CVE-2021-24703—Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin ActivationEPSS 0.4%CVE-2022-1316HIGHIncorrect Permission Assignment for Critical Resource in zerotier/zerotieroneEPSS 0.4%CVE-2024-11176MEDIUMIncorrect evaluation of effective permissions in M-Files AinoEPSS 0.4%CVE-2026-20693MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26EPSS 0.4%CVE-2026-62195HIGHOpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopbackEPSS 0.4%CVE-2024-55411HIGHAn issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via suEPSS 0.4%CVE-2023-32162HIGHWacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-45471HIGHInsecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.EPSS 0.4%CVE-2025-4609CRITICALIncorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attackerEPSS 0.4%