Falhas do tipo CWE-250

372 resultados

Execução com privilégios desnecessários

A aplicação ou processo executa com mais permissões (root, admin, service account privilegiado) do que realmente precisa para suas funções. Quando explorada, uma vulnerabilidade no código ganha acesso elevado, permitindo ao atacante comprometer todo o sistema ou dados sensíveis que só aquele nível de privilégio poderia acessar.

Exemplo

Um serviço web que apenas lê arquivos de configuração e envia emails roda como root. Uma injeção SQL nesse serviço não daria acesso apenas ao banco de dados, mas permitiria ao atacante criar usuários do SO, desabilitar firewalls ou acessar qualquer arquivo do servidor.

Como mitigar

Execute sempre com o menor nível de privilégio necessário — crie contas de serviço dedicadas e sem permissões administrativas. Revise regularmente as permissões de cada processo ou daemon em produção e remova acessos que não são estritamente usados.

CVE-2023-32486MEDIUM Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit EPSS 0.2%CVE-2026-3623HIGHVulnerabilities exists in IBM Netezza Performance Server Replication ServicesEPSS 0.2%CVE-2025-58379MEDIUMPassword Exposure in Brocade Fabric OSEPSS 0.2%CVE-2023-25521HIGH NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging EPSS 0.1%CVE-2025-3892MEDIUMACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be explEPSS 0.1%CVE-2026-8370HIGHAutomic Automation Agent Unix privilege escalationEPSS 0.1%CVE-2025-62876MEDIUMA Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affeEPSS 0.1%CVE-2026-80238CRITICALDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with UnEPSS 0.1%CVE-2025-24331MEDIUMNokia Single RAN baseband OAM service extensive capabilitiesEPSS 0.1%CVE-2026-67609HIGHTelenia TVox 26.5.3 Privilege Escalation via Insecure sudoers ConfigurationEPSS 0.1%CVE-2025-21110MEDIUMDell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker EPSS 0.1%CVE-2025-46430HIGHDell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the InstEPSS 0.1%CVE-2025-14096HIGHCredential Disclosure vulnerability in Radiometer ProductsEPSS 0.1%CVE-2024-8903MEDIUMLocal active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: AcronisEPSS 0.1%CVE-2025-43990HIGHDell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged EPSS 0.1%CVE-2024-51722MEDIUMVulnerabilities in SecuSUITE Server Components Impact SecuSUITEEPSS 0.1%CVE-2026-25710HIGHThe new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmaEPSS 0.1%CVE-2024-13090HIGHPrivilege escalation in Guardian/CMC before 24.6.0EPSS 0.1%CVE-2025-40767HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs dockEPSS 0.1%CVE-2026-48098HIGHNexTOR IP Changer Unsafely Uses sudo and shell=TrueEPSS 0.1%