Falhas do tipo CWE-264

299 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2019-11771—AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.EPSS 0.4%CVE-2018-0352—A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticatedEPSS 0.4%CVE-2019-1593HIGHCisco NX-OS Software Bash Shell Role-Based Access Control Bypass Privilege Escalation VulnerabilityEPSS 0.4%CVE-2019-12808—ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attackerEPSS 0.4%CVE-2019-1600MEDIUMCisco FXOS and NX-OS Software Unauthorized Directory Access VulnerabilityEPSS 0.4%CVE-2020-3473HIGHCisco IOS XR Software Authenticated User Privilege Escalation VulnerabilityEPSS 0.4%CVE-2019-1602HIGHCisco NX-OS Software Privilege Escalation VulnerabilityEPSS 0.4%CVE-2020-3265HIGHCisco SD-WAN Solution Privilege Escalation VulnerabilityEPSS 0.4%CVE-2017-12342—A vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to rEPSS 0.4%CVE-2026-9368MEDIUMNousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandboxEPSS 0.4%CVE-2019-11773—Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.EPSS 0.4%CVE-2019-1648HIGHCisco SD-WAN Solution Privilege Escalation VulnerabilityEPSS 0.4%CVE-2017-6638—A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attEPSS 0.4%CVE-2019-1966HIGHCisco Unified Computing System Fabric Interconnect root Privilege Escalation VulnerabilityEPSS 0.4%CVE-2019-1592HIGHCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Privilege Escalation VulnerabilityEPSS 0.4%CVE-2018-15370—Cisco Catalyst 6800 Series Switches ROM Monitor Software Secure Boot Bypass VulnerabilityEPSS 0.4%CVE-2017-12266—A vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow an authenticated, local attacker to run an EPSS 0.4%CVE-2020-3215MEDIUMCisco IOS XE Software Privilege Escalation VulnerabilityEPSS 0.4%CVE-2020-3214MEDIUMCisco IOS XE Software Privilege Escalation VulnerabilityEPSS 0.4%CVE-2017-12268—A vulnerability in the Network Access Manager (NAM) of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker EPSS 0.4%