Falhas do tipo CWE-73

668 resultados

Controle de acesso inadequado

A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.

Exemplo

Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.

Como mitigar

Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.

CVE-2023-0003MEDIUMCortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR ServerEPSS 1.3%CVE-2023-49738HIGHAn information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A speciallyEPSS 1.3%CVE-2025-24996MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 1.3%CVE-2024-27943HIGHA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload geneEPSS 1.3%CVE-2024-43615HIGHMicrosoft OpenSSH for Windows Remote Code Execution VulnerabilityEPSS 1.2%CVE-2021-3845—External Control of File Name or Path in netristv/ws-scrcpyEPSS 1.2%CVE-2025-26646HIGH.NET, Visual Studio, and Build Tools for Visual Studio Spoofing VulnerabilityEPSS 1.2%CVE-2020-5297LOWUpload whitelisted files to any directory in OctoberCMSEPSS 1.2%CVE-2022-2638—Export All URLs < 4.4 - Admin+ Arbitrary System File RemovalEPSS 1.2%CVE-2026-29962HIGHHSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The eEPSS 1.2%CVE-2023-2152MEDIUMSourceCodester Student Study Center Desk Management System index.php file inclusionEPSS 1.2%CVE-2025-71338CRITICALFlowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APIEPSS 1.2%CVE-2022-2400MEDIUMExternal Control of File Name or Path in dompdf/dompdfEPSS 1.2%CVE-2021-38477CRITICALAUVESY VersiondogEPSS 1.2%CVE-2020-9752—Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through iEPSS 1.1%CVE-2025-59185MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 1.1%CVE-2024-12058MEDIUMExternal control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a rEPSS 1.1%CVE-2023-35308MEDIUMWindows MSHTML Platform Security Feature Bypass VulnerabilityEPSS 1.1%CVE-2018-19945—Improper Limitation of a Pathname to a Restricted Directory in QTSEPSS 1.1%CVE-2026-54108MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.1%