Fallos del tipo CWE-749

190 resultados

Método ou função perigosa exposta

Ocorre quando uma aplicação disponibiliza públicamente um método ou função que não deveria ser acessível, permitindo que um atacante execute operações privilegiadas ou sensíveis. O risco é que funcionalidades internas críticas (debug, administração, operações de sistema) fiquem acessíveis sem autenticação ou validação adequada.

Ejemplo

Um serviço web expõe um endpoint remoto para rebootar o servidor ou executar comandos SQL diretos, ou uma biblioteca Python publica uma função de teste que apaga dados sem verificação. Qualquer cliente consegue chamar esses métodos e comprometer a integridade do sistema.

Cómo mitigar

Marque métodos sensíveis com modificadores de acesso restritivos (private, protected), revise regularmente quais funções estão realmente expostas na API pública, e implemente autenticação e autorização explícitas antes de permitir operações críticas. Use linters e ferramentas de análise estática para detectar exposições acidentais.

CVE-2023-38101HIGHNETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.1%CVE-2019-18342CRITICALA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the CoEPSS 2.1%CVE-2019-10918—A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.EPSS 1.9%CVE-2023-39468HIGHTriangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 1.9%CVE-2014-0758—ICONICS GENESIS32 Exposed Dangerous Method or FunctionEPSS 1.9%CVE-2023-40501CRITICALLG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-40500CRITICALLG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-5298HIGHD-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-5299HIGHD-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.8%CVE-2023-39470HIGHPaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 1.8%CVE-2020-8212—Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10EPSS 1.6%CVE-2023-51574CRITICALVoltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass VulnerabilityEPSS 1.6%CVE-2023-51583CRITICALVoltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-51582CRITICALVoltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-51581CRITICALVoltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-51575CRITICALVoltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-50422CRITICALEscalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)EPSS 1.4%CVE-2020-12928—A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT autEPSS 1.3%CVE-2023-51578HIGHVoltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service VulnerabilityEPSS 1.3%CVE-2019-20923MEDIUMCrash while handling internal Javascript exception typesEPSS 1.3%