Falhas do tipo CWE-269

2.510 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2024-31318HIGHIn CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permissioEPSS 0.1%CVE-2024-40658HIGHIn getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to EPSS 0.1%CVE-2024-29741HIGHIn pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. This could lead to local escalation ofEPSS 0.1%CVE-2021-25363MEDIUMAn improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running processEPSS 0.1%CVE-2023-48406—there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. This could lead to locaEPSS 0.1%CVE-2021-25513LOWAn improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthorized access to some dEPSS 0.1%CVE-2023-21396—In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation ofEPSS 0.1%CVE-2026-20246MEDIUMCisco Umbrella Virtual Appliance Privilege Escalation VulnerabilityEPSS 0.1%CVE-2021-25362MEDIUMAn improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to delete certain local filEPSS 0.1%CVE-2026-12858HIGHLocal privilege escalation vulnerability in ESET AV RemoverEPSS 0.1%CVE-2024-23711HIGHIn DevmemXIntUnreserveRange of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This couldEPSS 0.1%CVE-2024-31322MEDIUMIn updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retaininEPSS 0.1%CVE-2021-25428—Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous leEPSS 0.1%CVE-2024-31323HIGHIn onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could leadEPSS 0.1%CVE-2022-32633MEDIUMIn Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System exeEPSS 0.1%CVE-2022-22266MEDIUM(Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allowEPSS 0.1%CVE-2023-21343—In ActivityStarter, there is a possible background activity launch due to an unsafe PendingIntent. This could lead to local escalation of prEPSS 0.1%CVE-2025-69689HIGHThe Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-suEPSS 0.1%CVE-2023-35676—In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafEPSS 0.1%CVE-2024-31313HIGHIn availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead toEPSS 0.1%