Falhas do tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2022-20448MEDIUMIn buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. TEPSS 0.1%CVE-2024-27134HIGHExcessive directory permissions in MLflow leads to local privilege escalation when using spark_udfEPSS 0.1%CVE-2025-13155HIGHAn improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code withEPSS 0.1%CVE-2025-53398HIGHThe Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,EPSS 0.1%CVE-2025-59485MEDIUMIncorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an EPSS 0.1%CVE-2026-110359HIGHHyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running frEPSS 0.1%CVE-2024-0034HIGHIn BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This couldEPSS 0.1%CVE-2026-0705MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before bEPSS 0.1%CVE-2025-1789MEDIUMLocal privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this vulnerability to gaiEPSS 0.1%CVE-2025-27246MEDIUMIncorrect default permissions for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may aEPSS 0.1%CVE-2026-123500MEDIUMVikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dumpEPSS 0.1%CVE-2025-57851MEDIUMMce: privilege escalation via excessive /etc/passwd permissionsEPSS 0.1%CVE-2025-61667HIGHDatadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissionsEPSS 0.1%CVE-2026-91895HIGHDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged EPSS 0.1%CVE-2025-69604HIGHAn issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary pEPSS 0.1%CVE-2024-40660HIGHIn setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the codEPSS 0.1%CVE-2021-47761HIGHMilleGPG5 5.7.2 Luglio 2021 (x64) - Local Privilege EscalationEPSS 0.1%CVE-2025-53919HIGHAn issue was discovered in the Portrait Dell Color Management application through 3.3.008 for Dell monitors, It creates a temporary folder, EPSS 0.1%CVE-2025-53947MEDIUMCognex In-Sight Explorer and In-Sight Camera Firmware Incorrect Default PermissionsEPSS 0.1%CVE-2025-27711MEDIUMIncorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User AppEPSS 0.1%