Falhas do tipo CWE-284

7.967 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2025-24229HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A saEPSS 0.8%CVE-2021-24781—Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value ChangeEPSS 0.8%CVE-2026-78745CRITICALAn issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug BrEPSS 0.8%CVE-2026-68004CRITICALAn issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, EPSS 0.8%CVE-2022-4689HIGHImproper Access Control in usememos/memosEPSS 0.8%CVE-2023-6761MEDIUMThecosy IceCMS User Data access controlEPSS 0.8%CVE-2025-14749MEDIUMNingyuanda TC155 ONVIF PTZ Control device_service access controlEPSS 0.8%CVE-2025-43194CRITICALThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app mEPSS 0.8%CVE-2025-2550MEDIUMD-Link DIR-618/DIR-605L DDNS Service formSetDDNS access controlEPSS 0.8%CVE-2025-2551MEDIUMD-Link DIR-618/DIR-605L formSetPortTr access controlEPSS 0.8%CVE-2018-0484MEDIUMCisco IOS and IOS XE Software Secure Shell Connection on VRF VulnerabilityEPSS 0.8%CVE-2025-2547MEDIUMD-Link DIR-618/DIR-605L formAdvNetwork access controlEPSS 0.8%CVE-2025-2552MEDIUMD-Link DIR-618/DIR-605L formTcpipSetup access controlEPSS 0.8%CVE-2017-18035—The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 wEPSS 0.8%CVE-2024-38175CRITICALAzure Managed Instance for Apache Cassandra Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-43141—TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.EPSS 0.8%CVE-2026-58617HIGHM365 Copilot for iOS Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-26474CRITICALXWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorEPSS 0.8%CVE-2025-24259CRITICALThis issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, EPSS 0.8%CVE-2023-41721CRITICALInstances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement deEPSS 0.8%