Falhas do tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2023-52106MEDIUMVulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability EPSS 0.3%CVE-2019-19100HIGHPrivilege escalation via B&R Automation Studio upgrade serviceEPSS 0.3%CVE-2024-56444HIGHCross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service EPSS 0.3%CVE-2020-8092LOWPrivilege escalation in Bitdefender AV for MacEPSS 0.3%CVE-2020-7257HIGHPrivilege Escalation vulnerability through Symbolic links in ENSEPSS 0.3%CVE-2020-7259MEDIUMUnsigned executable vulnerability in ENS can be used to bypass intended self-protection rulesEPSS 0.3%CVE-2023-52955MEDIUMVulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause feEPSS 0.2%CVE-2022-23714—A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which EPSS 0.2%CVE-2024-22452HIGHDell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. A low privilege user could potEPSS 0.2%CVE-2020-7255LOWPrivilege Escalation vulnerability  in ENSEPSS 0.2%CVE-2026-81644MEDIUMDoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2021-28497MEDIUMIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell mEPSS 0.2%CVE-2019-19107MEDIUMABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Information ExposureEPSS 0.2%CVE-2026-6117MEDIUMAstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandboxEPSS 0.2%CVE-2024-54104MEDIUMCross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service EPSS 0.2%CVE-2020-1630MEDIUMJunos OS: Privilege escalation vulnerability in dual REs, VC or HA cluster may allow unauthorized configuration change.EPSS 0.2%CVE-2026-101102MEDIUMdeepseek-ai deepseek-harness Code Mode Sandbox run_code sandboxEPSS 0.2%CVE-2020-11933HIGHlocal snapd exploit through cloud-initEPSS 0.2%CVE-2024-56440MEDIUMPermission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perfEPSS 0.2%CVE-2024-45442MEDIUMVulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability wEPSS 0.2%