Falhas do tipo CWE-250

399 resultados

Execução com privilégios desnecessários

A aplicação ou processo executa com mais permissões (root, admin, service account privilegiado) do que realmente precisa para suas funções. Quando explorada, uma vulnerabilidade no código ganha acesso elevado, permitindo ao atacante comprometer todo o sistema ou dados sensíveis que só aquele nível de privilégio poderia acessar.

Exemplo

Um serviço web que apenas lê arquivos de configuração e envia emails roda como root. Uma injeção SQL nesse serviço não daria acesso apenas ao banco de dados, mas permitiria ao atacante criar usuários do SO, desabilitar firewalls ou acessar qualquer arquivo do servidor.

Como mitigar

Execute sempre com o menor nível de privilégio necessário — crie contas de serviço dedicadas e sem permissões administrativas. Revise regularmente as permissões de cada processo ou daemon em produção e remova acessos que não são estritamente usados.

CVE-2024-48013HIGHDell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Execution with Unnecessary Privileges vulneEPSS 0.7%CVE-2019-16784HIGHLocal Privilege Escalation present only on the Windows version of PyInstallerEPSS 0.7%CVE-2025-33223CRITICALNVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploiEPSS 0.7%CVE-2026-9209CRITICALmJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspxEPSS 0.7%CVE-2017-7518MEDIUMA flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulatioEPSS 0.7%CVE-2025-6893CRITICALAn Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in brokEPSS 0.7%CVE-2026-18949HIGHOdh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resourcesEPSS 0.7%CVE-2026-65162CRITICALNVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supplyEPSS 0.7%CVE-2026-92574HIGHCri-o: cri-o checkpoint restore bypasses destination security contextEPSS 0.7%CVE-2022-21699HIGHExecution with Unnecessary Privileges in ipythonEPSS 0.7%CVE-2025-22366HIGHMennekes smart/premium charges systems, Command injection in firmware upgradeEPSS 0.6%CVE-2025-22368HIGHMennekes smart/premium charges systems, Command injection in sCU firmware updateEPSS 0.6%CVE-2025-22367HIGHMennekes smart/premium charges systems, Command injection in time settingEPSS 0.6%CVE-2021-25653HIGHAvaya Aura Appliance Virtualization Platform Utilities Privilege Escalation VulnerabilityEPSS 0.6%CVE-2026-87899CRITICALExecution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.EPSS 0.6%CVE-2024-35783CRITICALA vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5EPSS 0.6%CVE-2025-33108HIGHIBM Backup Recovery and Media Services for i code executionEPSS 0.6%CVE-2022-38694HIGHIn BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution priviEPSS 0.6%CVE-2023-27313HIGHPrivilege Escalation Vulnerability in SnapCenterEPSS 0.6%CVE-2025-6894MEDIUMAn Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the EPSS 0.6%