Fallos del tipo CWE-73

671 resultados

Controle de acesso inadequado

A aplicação falha em validar ou reforçar adequadamente quem pode acessar determinados recursos, funcionalidades ou dados. Um usuário consegue executar ações ou visualizar informações para as quais não deveria ter permissão, porque o sistema não verifica corretamente as credenciais ou privilégios.

Ejemplo

Uma API de e-commerce permite que qualquer usuário logado modifique pedidos alheios mudando apenas o ID na URL (ex: /pedido/123 para /pedido/124), sem verificar se o pedido pertence a quem faz a requisição. Outro caso: um painel administrativo é acessível apenas alterando uma flag no navegador ou sendo deixado públicamente sem autenticação.

Cómo mitigar

Implemente verificações de autorização em toda operação sensível (sempre validar que o usuário é dono ou tem permissão explícita). Use listas de controle de acesso (ACL) ou modelos RBAC/ABAC centralizados e não confie apenas em obfuscação de IDs ou dados do lado do cliente. Teste acesso com usuários de diferentes papéis para garantir isolamento.

CVE-2025-8998LOWIt was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. ThiEPSS 0.2%CVE-2024-4230HIGHExternal Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic SoftEPSS 0.2%CVE-2026-30289HIGHAn arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal EPSS 0.2%CVE-2023-34982MEDIUMAVEVA Operations Control Logger External Control of File Name or Path EPSS 0.2%CVE-2024-25965MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilegeEPSS 0.2%CVE-2026-30287HIGHAn arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical iEPSS 0.2%CVE-2026-91797HIGHFoxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution VulnerabilityEPSS 0.2%CVE-2021-34761MEDIUMCisco Firepower Threat Defense Software CLI Arbitrary File Write VulnerabilityEPSS 0.2%CVE-2025-65799MEDIUMA lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traverEPSS 0.2%CVE-2021-1306MEDIUMCisco ADE-OS Local File Inclusion VulnerabilityEPSS 0.2%CVE-2024-36473MEDIUMTrend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to loEPSS 0.2%CVE-2025-32802MEDIUMInsecure handling of file paths allows multiple local attacksEPSS 0.2%CVE-2026-30284HIGHAn arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the EPSS 0.2%CVE-2026-53449MEDIUMCoturn: Arbitrary File Write via CLI psd CommandEPSS 0.2%CVE-2026-30291HIGHAn arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internaEPSS 0.2%CVE-2026-30292HIGHAn arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal fiEPSS 0.2%CVE-2026-46345HIGHcompliance-trestle - jinja has an Arbitrary File Write via Path TraversalEPSS 0.2%CVE-2026-58484HIGHNetwork-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruningEPSS 0.2%CVE-2024-20366HIGHA vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator EPSS 0.2%CVE-2026-47425MEDIUMRattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)EPSS 0.2%