Falhas do tipo CWE-276

981 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2026-86836HIGHIn Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaEPSS 0.1%CVE-2024-43085HIGHIn handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due toEPSS 0.1%CVE-2025-13905HIGHCWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or moEPSS 0.1%CVE-2026-39454HIGHSKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission setEPSS 0.1%CVE-2026-28727HIGHLocal privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) beEPSS 0.1%CVE-2026-2915MEDIUMHP System Event Utility – Denial of ServiceEPSS 0.1%CVE-2025-52640MEDIUMHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2025-8421MEDIUMAn improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could aEPSS 0.1%CVE-2024-58050MEDIUMVulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.1%CVE-2026-107332MEDIUMInsecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio CodeEPSS 0.1%CVE-2025-48512HIGHIncorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attackEPSS 0.1%CVE-2026-27653MEDIUMThe installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow aEPSS 0.1%CVE-2025-31940MEDIUMIncorrect default permissions for some Intel(R) Thread Director Visualizer software before version 1.1.1 within Ring 3: User Applications maEPSS 0.1%CVE-2026-44469HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%CVE-2025-30518MEDIUMIncorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow an escalation of EPSS 0.1%CVE-2026-21131LOWIncorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung FEPSS 0.1%CVE-2026-0432HIGHIncorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalatiEPSS 0.1%CVE-2026-21765HIGHHCL BigFix Platform is affected by insecure permissions on private cryptographic keysEPSS 0.1%CVE-2025-43887HIGHDell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability. A low privileEPSS 0.1%CVE-2025-22425MEDIUMIn onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalatiEPSS 0.1%