Fallos del tipo CWE-749

174 resultados

Método ou função perigosa exposta

Ocorre quando uma aplicação disponibiliza públicamente um método ou função que não deveria ser acessível, permitindo que um atacante execute operações privilegiadas ou sensíveis. O risco é que funcionalidades internas críticas (debug, administração, operações de sistema) fiquem acessíveis sem autenticação ou validação adequada.

Ejemplo

Um serviço web expõe um endpoint remoto para rebootar o servidor ou executar comandos SQL diretos, ou uma biblioteca Python publica uma função de teste que apaga dados sem verificação. Qualquer cliente consegue chamar esses métodos e comprometer a integridade do sistema.

Cómo mitigar

Marque métodos sensíveis com modificadores de acesso restritivos (private, protected), revise regularmente quais funções estão realmente expostas na API pública, e implemente autenticação e autorização explícitas antes de permitir operações críticas. Use linters e ferramentas de análise estática para detectar exposições acidentais.

CVE-2021-34996HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authEPSS 82.3%CVE-2010-0738MEDIUMThe JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 aEPSS 79.4%KEVCVE-2018-10931CRITICALIt was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker EPSS 67.9%CVE-2010-1428HIGHThe Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09EPSS 62.3%KEVCVE-2023-38124HIGHInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 59.6%CVE-2006-1547HIGHActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service vEPSS 54.6%KEVCVE-2023-27363HIGHFoxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 47.0%CVE-2023-51573CRITICALVoltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass VulnerabilityEPSS 45.7%CVE-2026-22812HIGHOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command ExecutionEPSS 17.0%CVE-2021-28809CRITICALMissing Authentication for Critical Function in RTRR Server in HBS3EPSS 15.8%CVE-2023-49074HIGHA denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.EPSS 13.5%CVE-2020-15623CRITICALThis vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthentEPSS 8.3%CVE-2020-17388HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 7.5%CVE-2021-42128—An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via EEPSS 4.5%CVE-2014-5415CRITICALBeckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or FunctionEPSS 4.3%CVE-2021-26614HIGHIpTime C200 IP camera remote code execution vulnerabilityEPSS 2.5%CVE-2016-9469—Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequesEPSS 2.4%CVE-2023-44414CRITICALD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.4%CVE-2025-26651MEDIUMWindows Local Session Manager (LSM) Denial of Service VulnerabilityEPSS 2.3%CVE-2023-38097HIGHNETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.1%