Falhas do tipo CWE-284

7.155 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-83149CRITICALVulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability alEPSS 0.3%CVE-2025-7552MEDIUMDromara Northstar Path AuthorizationInterceptor.java preHandle access controlEPSS 0.3%CVE-2024-20938MEDIUMVulnerability in the Oracle iStore product of Oracle E-Business Suite (component: ECC). Supported versions that are affected are 12.2.3-12.EPSS 0.3%CVE-2024-21150MEDIUMVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are EPSS 0.3%CVE-2024-20936MEDIUMVulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are aEPSS 0.3%CVE-2023-31346MEDIUMFailure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests. EPSS 0.3%CVE-2024-6727MEDIUMBroken Access Control in DelphixEPSS 0.3%CVE-2026-29197MEDIUMIn versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/EPSS 0.3%CVE-2026-84651MEDIUMIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submEPSS 0.3%CVE-2026-23660HIGHWindows Admin Center in Azure Portal Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-27702MEDIUMPermissions bypass in the management console of Absolute Secure Access prior to version 13.54EPSS 0.3%CVE-2026-42177MEDIUMlinux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are grantedEPSS 0.3%CVE-2026-73918HIGHVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected aEPSS 0.3%CVE-2025-54339CRITICALAn Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitEPSS 0.3%CVE-2026-87145HIGHVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supportEPSS 0.3%CVE-2026-61267HIGHVulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Spreadsheet Loading). Supported versEPSS 0.3%CVE-2025-56499MEDIUMIncorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated pEPSS 0.3%CVE-2024-38518MEDIUMbbb-web API additional parameters consideredEPSS 0.3%CVE-2026-35314HIGHVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). Supported versions that are EPSS 0.3%CVE-2026-73891HIGHVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected aEPSS 0.3%