Fallos del tipo CWE-732

792 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2026-65069MEDIUMData::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.2%CVE-2024-21063MEDIUMVulnerability in the PeopleSoft Enterprise HCM Benefits Administration product of Oracle PeopleSoft (component: Benefits Administration). EPSS 0.2%CVE-2025-8148MEDIUMCVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFTEPSS 0.2%CVE-2026-2637HIGHiBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes anEPSS 0.2%CVE-2026-49445CRITICALCilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket accessEPSS 0.2%CVE-2024-10526HIGHRapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor ServiceEPSS 0.2%CVE-2025-10541HIGHLocal Privilege Escalation via Insecure Update Mechanism in iMonitor EAMEPSS 0.2%CVE-2021-38483MEDIUMICSA-22-109-03 FANUC ROBOGUIDE Simulation PlatformEPSS 0.2%CVE-2022-39062HIGHA vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly set permissions for pEPSS 0.2%CVE-2026-35341HIGHuutils coreutils mkfifo Unauthorized Permission Change on Existing FilesEPSS 0.2%CVE-2023-1135HIGH In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory peEPSS 0.2%CVE-2026-13769MEDIUMOverly permissive File Permissions in AWS CLIEPSS 0.2%CVE-2026-26422HIGHclash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.EPSS 0.2%CVE-2025-5995MEDIUMCanon EOS Webcam Utility Pro for MAC OS contains an insecure permission issue potentially leading to code execution and privilege escalationEPSS 0.2%CVE-2025-24481HIGHFactoryTalk® View Site Edition - Incorrect Permission AssignmentEPSS 0.2%CVE-2022-39186MEDIUMEXFO - BV-10 Performance Endpoint Unit Misconfiguration EPSS 0.2%CVE-2023-28123MEDIUMA permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while EPSS 0.2%CVE-2026-6386MEDIUMMissing large page handling in pmap_pkru_update_range()EPSS 0.2%CVE-2023-45205HIGHA vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific fiEPSS 0.2%CVE-2025-67246HIGHA local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handlerEPSS 0.2%