Falhas do tipo CWE-73

768 resultados

Controle de acesso inadequado

A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.

Exemplo

Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.

Como mitigar

Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.

CVE-2019-3681HIGHosc: stores downloaded (supposed) RPM in network-controlled filesystem pathsEPSS 1.4%CVE-2026-11526CRITICALGD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandleEPSS 1.4%CVE-2024-27945HIGHA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a priEPSS 1.4%CVE-2025-24996MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 1.3%CVE-2024-38165MEDIUMWindows Compressed Folder Tampering VulnerabilityEPSS 1.3%CVE-2023-0003MEDIUMCortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR ServerEPSS 1.3%CVE-2023-49738HIGHAn information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A speciallyEPSS 1.3%CVE-2021-3845—External Control of File Name or Path in netristv/ws-scrcpyEPSS 1.3%CVE-2025-26646HIGH.NET, Visual Studio, and Build Tools for Visual Studio Spoofing VulnerabilityEPSS 1.3%CVE-2024-27943HIGHA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload geneEPSS 1.3%CVE-2024-43615HIGHMicrosoft OpenSSH for Windows Remote Code Execution VulnerabilityEPSS 1.2%CVE-2022-2400MEDIUMExternal Control of File Name or Path in dompdf/dompdfEPSS 1.2%CVE-2022-2638—Export All URLs < 4.4 - Admin+ Arbitrary System File RemovalEPSS 1.2%CVE-2020-5297LOWUpload whitelisted files to any directory in OctoberCMSEPSS 1.2%CVE-2023-2152MEDIUMSourceCodester Student Study Center Desk Management System index.php file inclusionEPSS 1.2%CVE-2025-71338CRITICALFlowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APIEPSS 1.2%CVE-2021-38477CRITICALAUVESY VersiondogEPSS 1.2%CVE-2020-9752—Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through iEPSS 1.1%CVE-2025-59185MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 1.1%CVE-2026-15307HIGHServer-side file-write and request forgery via spatial lookupsEPSS 1.1%