Falhas do tipo CWE-284

7.170 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2025-68623HIGHIn Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace an executable file during the installationEPSS 0.1%CVE-2024-43101MEDIUMImproper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an EPSS 0.1%CVE-2026-60685MEDIUMVulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affecEPSS 0.1%CVE-2026-64871MEDIUMJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extensionEPSS 0.1%CVE-2026-55979MEDIUMImproper access control check in CatchPulse's named pipe communication interfaceEPSS 0.1%CVE-2024-34543MEDIUMImproper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalatEPSS 0.1%CVE-2022-40539HIGHImproper Validation of Array Index in Automotive Android OSEPSS 0.1%CVE-2026-70714MEDIUMVulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is aEPSS 0.1%CVE-2026-83240HIGHVulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). TheEPSS 0.1%CVE-2026-60149MEDIUMVulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that EPSS 0.1%CVE-2026-60191MEDIUMVulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affeEPSS 0.1%CVE-2026-4823LOWEnter Software Iperius Backup NTLM2 information disclosureEPSS 0.1%CVE-2024-1343MEDIUMWeak permission vulnerability in LaborOfficeFreeEPSS 0.1%CVE-2026-20684LOWA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checksEPSS 0.1%CVE-2026-21084MEDIUMImproper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.EPSS 0.1%CVE-2026-70879HIGHVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supportEPSS 0.1%CVE-2026-70992HIGHVulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content AcquiEPSS 0.1%CVE-2026-50605HIGHPrivilege Escalation Vulnerability in NitroSense and PredatorSense SoftwareEPSS 0.1%CVE-2026-71041HIGHVulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Gantt Chart). The supported version that is affected is 9EPSS 0.1%CVE-2026-62449HIGHVulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that arEPSS 0.1%