Falhas do tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2026-0539HIGHLocal Privilege Escalation in pcvisit service clientEPSS 0.1%CVE-2024-31312MEDIUMIn multiple locations, there is a possible information leak due to a missing permission check. This could lead to local information disclosuEPSS 0.1%CVE-2022-25815MEDIUMPendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized EPSS 0.1%CVE-2026-11813HIGHA potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated usEPSS 0.1%CVE-2023-21129—In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch while the app is in the bEPSS 0.1%CVE-2025-13905HIGHCWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or moEPSS 0.1%CVE-2026-48722MEDIUMNextflow: Incorrect default permissions in the nextflow auth login commandEPSS 0.1%CVE-2022-25814MEDIUMPendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthEPSS 0.1%CVE-2026-92252MEDIUMIncorrect Default Permissions in WatchDog Anti-Virus Installation DirectoryEPSS 0.1%CVE-2022-30758MEDIUMImplicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected informatioEPSS 0.1%CVE-2025-22425MEDIUMIn onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalatiEPSS 0.1%CVE-2025-31940MEDIUMIncorrect default permissions for some Intel(R) Thread Director Visualizer software before version 1.1.1 within Ring 3: User Applications maEPSS 0.1%CVE-2026-24414MEDIUMIcinga for Windows certificate can have too-open permissionsEPSS 0.1%CVE-2025-30518MEDIUMIncorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow an escalation of EPSS 0.1%CVE-2018-9434HIGHIn multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could lead to local escalatiEPSS 0.1%CVE-2024-43089HIGHIn updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could leEPSS 0.1%CVE-2024-20005HIGHIn da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with SystemEPSS 0.1%CVE-2018-9401HIGHIn many locations, there is a possible way to access kernel memory in user space due to an incorrect bounds check. This could lead to local EPSS 0.1%CVE-2026-2915MEDIUMHP System Event Utility – Denial of ServiceEPSS 0.1%CVE-2024-40661HIGHIn mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permisEPSS 0.1%