Fallos del tipo CWE-749

217 resultados

Método ou função perigosa exposta

Ocorre quando uma aplicação disponibiliza públicamente um método ou função que não deveria ser acessível, permitindo que um atacante execute operações privilegiadas ou sensíveis. O risco é que funcionalidades internas críticas (debug, administração, operações de sistema) fiquem acessíveis sem autenticação ou validação adequada.

Ejemplo

Um serviço web expõe um endpoint remoto para rebootar o servidor ou executar comandos SQL diretos, ou uma biblioteca Python publica uma função de teste que apaga dados sem verificação. Qualquer cliente consegue chamar esses métodos e comprometer a integridade do sistema.

Cómo mitigar

Marque métodos sensíveis com modificadores de acesso restritivos (private, protected), revise regularmente quais funções estão realmente expostas na API pública, e implemente autenticação e autorização explícitas antes de permitir operações críticas. Use linters e ferramentas de análise estática para detectar exposições acidentais.

CVE-2023-3612HIGHUnprotected WebView access in Govee Home AppEPSS 0.5%CVE-2026-61793MEDIUMNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameterEPSS 0.5%CVE-2026-30921CRITICALOneUptime Synthetic Monitor RCE via exposed Playwright browser objectEPSS 0.5%CVE-2025-53964CRITICALGoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary andEPSS 0.5%CVE-2021-33639HIGHREMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.EPSS 0.5%CVE-2026-120091HIGHTemporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service hostEPSS 0.5%CVE-2025-14713HIGHAn Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote atEPSS 0.5%CVE-2020-12912—A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power LEPSS 0.5%CVE-2024-47005HIGHSharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficientEPSS 0.5%CVE-2026-3483HIGHAn exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.EPSS 0.5%CVE-2026-2275CRITICALCVE-2026-2275EPSS 0.5%CVE-2025-64443HIGHDNS Rebinding vulnerability present when running MCP Gateway in sse or streaming modeEPSS 0.5%CVE-2026-5173HIGHExposed Dangerous Method or Function in GitLabEPSS 0.4%CVE-2024-32764CRITICALmyQNAPcloud LinkEPSS 0.4%CVE-2025-3698HIGHInterface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk.EPSS 0.4%CVE-2025-61907HIGHIcinga 2 API users could access restricted values in filter expressionsEPSS 0.4%CVE-2025-5748HIGHWOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-52877HIGHStreambert : Insecure Protocol Execution in open-external IPC HandlerEPSS 0.4%CVE-2023-39493HIGHPDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-89110CRITICALBroken Access Control in SAP NetWeaver Visual ComposerEPSS 0.4%