Falhas do tipo CWE-250

399 resultados

Execução com privilégios desnecessários

A aplicação ou processo executa com mais permissões (root, admin, service account privilegiado) do que realmente precisa para suas funções. Quando explorada, uma vulnerabilidade no código ganha acesso elevado, permitindo ao atacante comprometer todo o sistema ou dados sensíveis que só aquele nível de privilégio poderia acessar.

Exemplo

Um serviço web que apenas lê arquivos de configuração e envia emails roda como root. Uma injeção SQL nesse serviço não daria acesso apenas ao banco de dados, mas permitiria ao atacante criar usuários do SO, desabilitar firewalls ou acessar qualquer arquivo do servidor.

Como mitigar

Execute sempre com o menor nível de privilégio necessário — crie contas de serviço dedicadas e sem permissões administrativas. Revise regularmente as permissões de cada processo ou daemon em produção e remova acessos que não são estritamente usados.

CVE-2026-21421MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges EPSS 0.1%CVE-2024-13090HIGHPrivilege escalation in Guardian/CMC before 24.6.0EPSS 0.1%CVE-2026-21424MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges EPSS 0.1%CVE-2023-25521HIGH NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging EPSS 0.1%CVE-2025-46430HIGHDell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the InstEPSS 0.1%CVE-2026-8370HIGHAutomic Automation Agent Unix privilege escalationEPSS 0.1%CVE-2025-43990HIGHDell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged EPSS 0.1%CVE-2025-12690HIGHLocal Privilege Escalation in NGFW EngineEPSS 0.1%CVE-2026-0870HIGHGIGABYTE｜MacroHub - Local Privilege EscalationEPSS 0.1%CVE-2026-95652MEDIUMImproper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatterEPSS 0.1%CVE-2025-33003HIGHIBM InfoSphere Information Server is vulnerable to privilege escalationEPSS 0.1%CVE-2025-40767HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs dockEPSS 0.1%CVE-2024-8903MEDIUMLocal active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: AcronisEPSS 0.1%CVE-2025-14096HIGHCredential Disclosure vulnerability in Radiometer ProductsEPSS 0.1%CVE-2026-25710HIGHThe new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmaEPSS 0.1%CVE-2024-51722MEDIUMVulnerabilities in SecuSUITE Server Components Impact SecuSUITEEPSS 0.1%CVE-2026-19087MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.1%CVE-2025-36186HIGHIBM Db2 privilege escalationEPSS 0.1%CVE-2026-40573HIGHNovumOS: Nova Interpreter Privilege EscalationEPSS 0.1%CVE-2026-53605HIGHReachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl GrantEPSS 0.1%