Falhas do tipo CWE-250

399 resultados

Execução com privilégios desnecessários

A aplicação ou processo executa com mais permissões (root, admin, service account privilegiado) do que realmente precisa para suas funções. Quando explorada, uma vulnerabilidade no código ganha acesso elevado, permitindo ao atacante comprometer todo o sistema ou dados sensíveis que só aquele nível de privilégio poderia acessar.

Exemplo

Um serviço web que apenas lê arquivos de configuração e envia emails roda como root. Uma injeção SQL nesse serviço não daria acesso apenas ao banco de dados, mas permitiria ao atacante criar usuários do SO, desabilitar firewalls ou acessar qualquer arquivo do servidor.

Como mitigar

Execute sempre com o menor nível de privilégio necessário — crie contas de serviço dedicadas e sem permissões administrativas. Revise regularmente as permissões de cada processo ou daemon em produção e remova acessos que não são estritamente usados.

CVE-2025-36356CRITICALIBM Security Verify Access privilege escalationEPSS 0.2%CVE-2023-38641HIGHA vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). The affected application's database service is executed as EPSS 0.2%CVE-2025-3364MEDIUMHGiga PowerStation - Chroot EscapeEPSS 0.2%CVE-2026-80238CRITICALDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with UnEPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%CVE-2026-75092HIGHLeapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable pluginsEPSS 0.2%CVE-2025-20185LOWCisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-22890MEDIUMExecution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specEPSS 0.2%CVE-2025-8907HIGHH3C M2 NAS Webserver Configuration unnecessary privilegesEPSS 0.2%CVE-2020-26074HIGHCisco SD-WAN vManage Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-15226HIGHsnapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp TemplatesEPSS 0.2%CVE-2026-104795HIGHInsights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary executionEPSS 0.2%CVE-2024-49804HIGHIBM Security Verify Access Appliance privilege escalationEPSS 0.2%CVE-2026-20017MEDIUMCisco Secure FTD Software Authenticated Command Injection VulnerabilityEPSS 0.2%CVE-2023-34118HIGHImproper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of priEPSS 0.2%CVE-2024-12673HIGHAn improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allowEPSS 0.2%CVE-2025-58432MEDIUMZimaOS Privilege Escalation using localhost calls to File API UploadEPSS 0.2%CVE-2026-24183HIGHNVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege manaEPSS 0.2%CVE-2026-8933HIGHsnap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment SetupEPSS 0.2%CVE-2025-1411HIGHIBM Security Verify Directory Container command executionEPSS 0.2%