Falhas do tipo CWE-749

190 resultados

Exposição de método ou função perigosa

Quando uma aplicação disponibiliza publicamente um método ou função que não deveria ser acessível, permitindo que atacantes a executem com consequências graves. O problema é expor funcionalidades sensíveis (como deleção de dados, mudança de permissões ou acesso a recursos críticos) sem validação adequada de quem está chamando.

Exemplo

Uma API REST expõe um endpoint `/admin/deleteUser` sem autenticação ou apenas com verificação de token fraco, permitindo qualquer pessoa deletar usuários da plataforma. Ou uma biblioteca carrega um método de configuração interna que permite alterar parâmetros de segurança diretamente via reflexão.

Como mitigar

Aplique princípio do menor privilégio: mantenha métodos sensíveis privados ou protegidos, exporte apenas o necessário e força autenticação + autorização rigorosa em tudo que fica acessível. Implemente validação de entrada e auditoria de quem acessa recursos críticos.

CVE-2020-12927—A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privilEPSS 0.3%CVE-2026-44836MEDIUMview_component: Preview Route Can Dispatch Inherited Helper MethodsEPSS 0.3%CVE-2025-24361MEDIUMOpening a malicious website while running a Nuxt dev server could allow read-only access to codeEPSS 0.3%CVE-2018-8868MEDIUMMedtronic MyCareLink Patient Monitor Exposed Dangerous Method or FunctionEPSS 0.3%CVE-2020-27123MEDIUMCisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read VulnerabilityEPSS 0.3%CVE-2024-51992MEDIUMMethod Exposure Vulnerability in Modals in orchid/platformEPSS 0.3%CVE-2020-10268—RVD#2550: Terminate Critical Services in KUKA controller KR C4EPSS 0.3%CVE-2020-3513MEDIUMCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesEPSS 0.3%CVE-2020-3416MEDIUMCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesEPSS 0.3%CVE-2024-35209MEDIUMA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowinEPSS 0.3%CVE-2023-37330HIGHKofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-12060MEDIUMHepta Platforms｜Heptabase - Exposed DangerousEPSS 0.3%CVE-2025-43003MEDIUMInformation Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)EPSS 0.3%CVE-2023-51577HIGHVoltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-44107HIGHExposed Reboot via ModbusEPSS 0.3%CVE-2026-33584MEDIUMArqit SKA-Platform Enables Access to Debug InformationEPSS 0.3%CVE-2025-59788MEDIUMCross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0EPSS 0.3%CVE-2026-6402MEDIUMwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originsEPSS 0.3%CVE-2026-49993MEDIUM@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)EPSS 0.3%CVE-2026-44798HIGHNautobot: GitRepository.current_head field should not be writable through REST APIEPSS 0.3%