Falhas do tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2025-24795MEDIUMThe Snowflake Connector for Python uses insecure cache files permissionsEPSS 0.1%CVE-2025-2781MEDIUMWatchGuard Mobile VPN with SSL Local Privilege Escalation via Non-Standard Installation DirectoryEPSS 0.1%CVE-2025-61970HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary codEPSS 0.1%CVE-2025-46185MEDIUMAn Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storaEPSS 0.1%CVE-2024-5474MEDIUMA potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2EPSS 0.1%CVE-2026-32680HIGHThe installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customEPSS 0.1%CVE-2025-32091HIGHIncorrect default permissions in some firmware for the Intel(R) Arc(TM) B-series GPUs within Ring 1: Device Drivers may allow an escalation EPSS 0.1%CVE-2024-49389HIGHLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before buiEPSS 0.1%CVE-2025-41658MEDIUMCODESYS Toolkit Exposes Sensitive Files via Default PermissionsEPSS 0.1%CVE-2025-21106MEDIUMDell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could poEPSS 0.1%CVE-2023-31246MEDIUMIncorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially eEPSS 0.1%CVE-2024-27264HIGHIBM Performance Tools for i privilege escalationEPSS 0.1%CVE-2023-27505MEDIUMIncorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow EPSS 0.1%CVE-2023-32547MEDIUMIncorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to poteEPSS 0.1%CVE-2026-11813HIGHA potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated usEPSS 0.1%CVE-2023-32543MEDIUMIncorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation oEPSS 0.1%CVE-2026-40952HIGHPrivilge misconfiguration in Secure Access installersEPSS 0.1%CVE-2026-58564HIGHDell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with lEPSS 0.1%CVE-2025-7024MEDIUMLocal privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)EPSS 0.1%CVE-2026-24063HIGHWorld-writable uninstall script executed as root in Arturia Software CenterEPSS 0.1%