Falhas do tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2019-1646HIGHPrivilege Escalation Vulnerability in Cisco SD-WAN SolutionEPSS 0.4%CVE-2019-15275MEDIUMCisco TelePresence Collaboration Endpoint Software Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-76412HIGHCisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root VulnerabilityEPSS 0.4%CVE-2017-12239—A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8 Converged EPSS 0.4%CVE-2018-0294—A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to cEPSS 0.4%CVE-2019-15277MEDIUMCisco TelePresence Collaboration Endpoint Software Privilege Escalation VulnerabilityEPSS 0.4%CVE-2020-3213MEDIUMCisco IOS XE Software Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-18593MEDIUMvxcontrol PentAGI Tool Management Protocol pentester.tmpl sandboxEPSS 0.4%CVE-2019-1625HIGHCisco SD-WAN Solution Privilege Escalation VulnerabilityEPSS 0.4%CVE-2020-8093MEDIUMCode Injection into Bitdefender AV for MacEPSS 0.4%CVE-2023-39380—Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnorEPSS 0.4%CVE-2023-39384—Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause featEPSS 0.4%CVE-2018-0453—Cisco Firepower Management Center and Firepower System Software Sourcefire Tunnel Control Channel Command Execution VulnerabilityEPSS 0.4%CVE-2020-7260HIGHMACC installer DLL side loadingEPSS 0.4%CVE-2025-20145MEDIUMCisco IOS XR Software Access Control List Bypass VulnerabilityEPSS 0.4%CVE-2020-8488HIGHABB System 800xA Inter process communication vulnerability - 800xA Batch ManagementEPSS 0.4%CVE-2019-1730MEDIUMCisco NX-OS Software Bash Bypass Guest Shell VulnerabilityEPSS 0.4%CVE-2018-0183—A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying LinEPSS 0.4%CVE-2018-0184—A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying LinEPSS 0.4%CVE-2018-0095—A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Security Management ApplianEPSS 0.4%