Falhas do tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2025-20087MEDIUMIncorrect default permissions for some Intel(R) oneAPI DPC++/C++ Compiler software installers may allow an authenticated user to potentiallyEPSS 0.1%CVE-2025-27559MEDIUMIncorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enaEPSS 0.1%CVE-2025-20023MEDIUMIncorrect default permissions for some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable esEPSS 0.1%CVE-2025-26470MEDIUMIncorrect default permissions for some Intel(R) Distribution for Python software installers before version 2025.1.0 may allow an authenticatEPSS 0.1%CVE-2024-40660HIGHIn setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the codEPSS 0.1%CVE-2026-28717MEDIUMLocal privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) beEPSS 0.1%CVE-2022-20448MEDIUMIn buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. TEPSS 0.1%CVE-2025-36511MEDIUMIncorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applications may allow an eEPSS 0.1%CVE-2025-57851MEDIUMMce: privilege escalation via excessive /etc/passwd permissionsEPSS 0.1%CVE-2025-53919HIGHAn issue was discovered in the Portrait Dell Color Management application through 3.3.008 for Dell monitors, It creates a temporary folder, EPSS 0.1%CVE-2025-48505HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged eEPSS 0.1%CVE-2025-32453MEDIUMIncorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privilEPSS 0.1%CVE-2026-39454HIGHSKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission setEPSS 0.1%CVE-2024-43085HIGHIn handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due toEPSS 0.1%CVE-2021-47761HIGHMilleGPG5 5.7.2 Luglio 2021 (x64) - Local Privilege EscalationEPSS 0.1%CVE-2025-59485MEDIUMIncorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an EPSS 0.1%CVE-2025-27246MEDIUMIncorrect default permissions for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may aEPSS 0.1%CVE-2026-2026MEDIUMImproper Access Control Allows Denial of ServiceEPSS 0.1%CVE-2025-53947MEDIUMCognex In-Sight Explorer and In-Sight Camera Firmware Incorrect Default PermissionsEPSS 0.1%CVE-2026-63425HIGHDuring an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could alloEPSS 0.1%