Falhas do tipo CWE-250

399 resultados

Execução com privilégios desnecessários

A aplicação ou processo executa com mais permissões (root, admin, service account privilegiado) do que realmente precisa para suas funções. Quando explorada, uma vulnerabilidade no código ganha acesso elevado, permitindo ao atacante comprometer todo o sistema ou dados sensíveis que só aquele nível de privilégio poderia acessar.

Exemplo

Um serviço web que apenas lê arquivos de configuração e envia emails roda como root. Uma injeção SQL nesse serviço não daria acesso apenas ao banco de dados, mas permitiria ao atacante criar usuários do SO, desabilitar firewalls ou acessar qualquer arquivo do servidor.

Como mitigar

Execute sempre com o menor nível de privilégio necessário — crie contas de serviço dedicadas e sem permissões administrativas. Revise regularmente as permissões de cada processo ou daemon em produção e remova acessos que não são estritamente usados.

CVE-2025-55002MEDIUMJupyterLab Desktop: TCC Bypass via Misconfigured Node FusesEPSS 0.2%CVE-2024-47120MEDIUMIBM Security Verify Information Queue code executionEPSS 0.2%CVE-2026-22008LOWVulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to expEPSS 0.2%CVE-2026-46748HIGHA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configureEPSS 0.2%CVE-2025-58431MEDIUMZimaOS reads arbitrary files using localhost calls to File API DownloadEPSS 0.2%CVE-2021-0255MEDIUMJunos OS: ethtraceroute Local Privilege Escalation vulnerability in SUID binariesEPSS 0.2%CVE-2023-20210MEDIUMA vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected devicEPSS 0.2%CVE-2022-38695HIGHIn BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privilEPSS 0.2%CVE-2026-21882HIGHtheshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-executionEPSS 0.2%CVE-2024-48837HIGHDell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulneEPSS 0.2%CVE-2026-67609HIGHTelenia TVox 26.5.3 Privilege Escalation via Insecure sudoers ConfigurationEPSS 0.2%CVE-2022-3088HIGHUC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v EPSS 0.2%CVE-2022-30695—Local privilege escalation due to excessive permissions assigned to child processesEPSS 0.2%CVE-2026-121196—Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictioEPSS 0.2%CVE-2022-41290HIGHIBM AIX privilege escalationEPSS 0.2%CVE-2025-3925HIGHBrightSign Players Execution with Unnecessary PrivilegesEPSS 0.2%CVE-2022-22239HIGHJunos OS Evolved: The ssh CLI command always runs as root which can lead to privilege escalationEPSS 0.2%CVE-2026-48098HIGHNexTOR IP Changer Unsafely Uses sudo and shell=TrueEPSS 0.2%CVE-2024-8781HIGHContainer Escape Vulnerability in TR7's Application Security Platform (ASP)EPSS 0.2%CVE-2025-36356CRITICALIBM Security Verify Access privilege escalationEPSS 0.2%