Falhas do tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2023-31358HIGHA DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inEPSS 0.2%CVE-2023-28966HIGHJunos OS Evolved: Local low-privileged user with shell access can execute CLI commands as rootEPSS 0.2%CVE-2024-2175HIGHAn insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)EPSS 0.2%CVE-2021-46834MEDIUMA permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked EPSS 0.2%CVE-2024-11969HIGHIncorrect default permissions in Cradlepoint NetCloud ExchangeEPSS 0.2%CVE-2025-9190MEDIUMTCC Bypass via misconfigured Node fuses in CursorEPSS 0.2%CVE-2024-42419MEDIUMIncorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potentEPSS 0.2%CVE-2021-41614HIGHAn issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program EPSS 0.2%CVE-2024-42028HIGHA Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and eaEPSS 0.2%CVE-2026-21423MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerabEPSS 0.2%CVE-2026-57895HIGHIncorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installatEPSS 0.2%CVE-2026-69665HIGHSKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attackeEPSS 0.2%CVE-2024-30977HIGHAn issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the passwEPSS 0.2%CVE-2023-25941HIGH Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local attacker could potentiEPSS 0.2%CVE-2026-12823MEDIUMBrowserbase Skills Autobrowse Trace Artifact default permissionEPSS 0.2%CVE-2025-46355HIGHIncorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on WiEPSS 0.2%CVE-2018-25359HIGHSplinterware System Scheduler Pro 5.12 Privilege EscalationEPSS 0.2%CVE-2024-4229HIGHIncorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software forEPSS 0.2%CVE-2025-52991LOWThe Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This aEPSS 0.2%CVE-2024-46463HIGHBy default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perfEPSS 0.2%