Falhas do tipo CWE-284

7.169 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2023-25777HIGHImproper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentEPSS 0.2%CVE-2023-24486MEDIUMLocal user access to a system where another user is utilizing a vulnerable version of Citrix Workspace App for Linux to launch published desktops and applicationsEPSS 0.2%CVE-2026-11210MEDIUMInappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary acceEPSS 0.2%CVE-2025-11641LOWTomofun Furbo 360/Furbo Mini Trial Restriction access controlEPSS 0.2%CVE-2026-17976MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a EPSS 0.2%CVE-2025-50108MEDIUMVulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Workspace). The supported version that is EPSS 0.2%CVE-2025-43294LOWAn issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.EPSS 0.2%CVE-2023-32458HIGH Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerability in Embedded SeEPSS 0.2%CVE-2023-47859MEDIUMImproper access control for some Intel(R) Wireless Bluetooth products for Windows before version 23.20 may allow an authenticated user to poEPSS 0.2%CVE-2023-40161MEDIUMImproper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user to potentially enablEPSS 0.2%CVE-2024-33396HIGHAn issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token coEPSS 0.2%CVE-2023-25073MEDIUMImproper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial ofEPSS 0.2%CVE-2023-22848MEDIUMImproper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentEPSS 0.2%CVE-2021-1113MEDIUMNVIDIA camera firmware contains a difficult to exploit vulnerability where a highly privileged attacker can cause unauthorized modification EPSS 0.2%CVE-2023-37194MEDIUMA vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATEPSS 0.2%CVE-2022-36374HIGHImproper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.0003 may allow a privilEPSS 0.2%CVE-2025-24516MEDIUMImproper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an infoEPSS 0.2%CVE-2026-3796MEDIUMQi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access controlEPSS 0.2%CVE-2024-6364MEDIUMServer Identity Validation Bypass in Absolute Persistence®EPSS 0.2%CVE-2023-24481MEDIUMImproper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentEPSS 0.2%