Falhas do tipo CWE-250

399 resultados

Execução com privilégios desnecessários

A aplicação ou processo executa com mais permissões (root, admin, service account privilegiado) do que realmente precisa para suas funções. Quando explorada, uma vulnerabilidade no código ganha acesso elevado, permitindo ao atacante comprometer todo o sistema ou dados sensíveis que só aquele nível de privilégio poderia acessar.

Exemplo

Um serviço web que apenas lê arquivos de configuração e envia emails roda como root. Uma injeção SQL nesse serviço não daria acesso apenas ao banco de dados, mas permitiria ao atacante criar usuários do SO, desabilitar firewalls ou acessar qualquer arquivo do servidor.

Como mitigar

Execute sempre com o menor nível de privilégio necessário — crie contas de serviço dedicadas e sem permissões administrativas. Revise regularmente as permissões de cada processo ou daemon em produção e remova acessos que não são estritamente usados.

CVE-2025-9055MEDIUMThe VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privilegesEPSS 0.1%CVE-2026-3315MEDIUMLocal Privilege Escalation Due to Writable Executable in Privileged Visionline Service PathEPSS 0.1%CVE-2026-40550MEDIUMPrivilege Escalation in multiple BinSoft productsEPSS 0.1%CVE-2026-40638MEDIUMDell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability. A high privileged EPSS 0.1%CVE-2025-46696MEDIUMDell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary EPSS 0.1%CVE-2026-75621MEDIUMIBM Aspera Enterprise Webapps Execution with Unnecessary PrivilegesEPSS 0.1%CVE-2025-1790MEDIUMLocal privilege escalation in Genetec Sipelia Plugin. An authenticated low-privileged Windows user could exploit this vulnerability to gain EPSS 0.1%CVE-2026-20037MEDIUMCisco UCS Manager File Write VulnerabilityEPSS 0.1%CVE-2025-34290HIGHVersa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege EscalationEPSS 0.1%CVE-2026-11626MEDIUMLocal Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal ToolEPSS 0.1%CVE-2025-36059MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%CVE-2026-42061HIGHLocal privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLockEPSS 0.1%CVE-2026-4667HIGHHP System Optimizer - Escalation of PrivilegeEPSS 0.1%CVE-2025-12694HIGHLocal Privilege Escalation in VPN ClientEPSS 0.1%CVE-2025-0079HIGHIn multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This couEPSS 0.1%CVE-2025-0080HIGHIn multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This coulEPSS 0.1%CVE-2026-25908MEDIUMDell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCCEPSS 0.1%CVE-2026-110150MEDIUMPrivilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive informatEPSS 0.1%CVE-2025-48573HIGHIn sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due tEPSS 0.1%