Falhas do tipo CWE-281

231 resultados

Preservação inadequada de permissões

Quando um programa cria, copia ou modifica arquivos e recursos, mas não mantém ou herda as permissões originais corretamente, permitindo acesso indevido. Isso expõe dados sensíveis ou permite que usuários não autorizados executem operações críticas.

Exemplo

Um backup que copia arquivos de configuração com credenciais, mas muda as permissões para leitura por qualquer usuário do sistema. Ou um instalador que cria diretórios temporários com permissões padrão abertas, deixando senhas de sessão visíveis para outros usuários locais.

Como mitigar

Sempre defina explicitamente permissões restritivas (ex: 0600 para arquivos sensíveis) logo após criar ou copiar arquivos. Use funções seguras da plataforma (chmod, SetSecurityDescriptor) e valide que as permissões foram aplicadas corretamente antes de escrever dados sensíveis.

CVE-2022-0330—A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code onEPSS 0.4%CVE-2023-4996MEDIUMLocal privilege escalation EPSS 0.4%CVE-2021-20263—A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capabilitEPSS 0.4%CVE-2025-7346HIGHAny unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packagesEPSS 0.4%CVE-2023-22738MEDIUMImproper Preservation of Permissions in vantage6EPSS 0.4%CVE-2025-22620MEDIUMgix-worktree-state nonexclusive checkout sets executable files world-writableEPSS 0.4%CVE-2026-39828MEDIUMInvoking bypass of certificate restrictions in golang.org/x/crypto/sshEPSS 0.4%CVE-2026-34744MEDIUMMantisBT authorization bypass allows continued access to self-uploaded attachments on private issuesEPSS 0.4%CVE-2025-32696NONE"reupload-own" restriction can be bypassed by reverting fileEPSS 0.4%CVE-2024-50928MEDIUMInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devicesEPSS 0.4%CVE-2024-43784MEDIUMRe-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletionEPSS 0.4%CVE-2026-61709MEDIUMOpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that userEPSS 0.4%CVE-2023-28642MEDIUMAppArmor bypass with symlinked /proc in runcEPSS 0.3%CVE-2023-42231HIGHPat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users byEPSS 0.3%CVE-2024-40800HIGHAn input validation issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macEPSS 0.3%CVE-2024-56178MEDIUMAn issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group EPSS 0.3%CVE-2026-58510MEDIUMGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateEPSS 0.3%CVE-2022-48301HIGHThe bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-iEPSS 0.3%CVE-2022-48295HIGHThe IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (baEPSS 0.3%CVE-2024-23560MEDIUMHCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type EPSS 0.3%