Falhas do tipo CWE-281

225 resultados

Preservação inadequada de permissões

Quando um programa cria, copia ou modifica arquivos e recursos, mas não mantém ou herda as permissões originais corretamente, permitindo acesso indevido. Isso expõe dados sensíveis ou permite que usuários não autorizados executem operações críticas.

Exemplo

Um backup que copia arquivos de configuração com credenciais, mas muda as permissões para leitura por qualquer usuário do sistema. Ou um instalador que cria diretórios temporários com permissões padrão abertas, deixando senhas de sessão visíveis para outros usuários locais.

Como mitigar

Sempre defina explicitamente permissões restritivas (ex: 0600 para arquivos sensíveis) logo após criar ou copiar arquivos. Use funções seguras da plataforma (chmod, SetSecurityDescriptor) e valide que as permissões foram aplicadas corretamente antes de escrever dados sensíveis.

CVE-2025-21544MEDIUMVulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).EPSS 0.3%CVE-2024-40828HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A malicEPSS 0.3%CVE-2025-31184HIGHThis issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.EPSS 0.3%CVE-2024-54513MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18EPSS 0.3%CVE-2022-4139HIGHAn incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or dataEPSS 0.3%CVE-2025-30449HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 0.3%CVE-2022-31237LOWDell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerabilityEPSS 0.2%CVE-2024-12125HIGH3scale-porta: readonly fields not validated server-sideEPSS 0.2%CVE-2024-47270LOWImproper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9EPSS 0.2%CVE-2024-52869MEDIUMCertain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when theEPSS 0.2%CVE-2023-25646HIGHPermission and Access Control Vulnerability in ZTE H388XEPSS 0.2%CVE-2023-32388—A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, EPSS 0.2%CVE-2024-40805HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.EPSS 0.2%CVE-2022-42260HIGHNVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VEPSS 0.2%CVE-2023-1386LOWQemu: 9pfs: suid/sgid bits not dropped on file writeEPSS 0.2%CVE-2024-22121MEDIUMZabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exeEPSS 0.2%CVE-2023-32400—This issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. EntitlementEPSS 0.2%CVE-2025-0914LOWVelociraptor Shell Plugin Prevent_execve BypassEPSS 0.2%CVE-2023-28646MEDIUMApp lockout in nextcloud Android app can be bypassed via thirdparty appsEPSS 0.2%CVE-2022-44020MEDIUMAn issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with thEPSS 0.2%