Fallos del tipo CWE-653

71 resultados

Falta de segregação de privilégios e funcionalidades

A aplicação não separa adequadamente componentes, processos ou recursos que exigem diferentes níveis de permissão, deixando funcionalidades críticas acessíveis a usuários com menos privilégios. Um atacante com acesso limitado consegue executar operações que deveriam estar restritas a administradores ou roles específicas.

Ejemplo

Uma API REST que usa a mesma função para listar tarefas do usuário e deletar todas as tarefas do sistema sem verificar se o chamador é admin. Um usuário comum consegue chamar a mesma rota com um parâmetro diferente e excluir dados de todos.

Cómo mitigar

Implemente verificações de autorização em cada operação sensível (não confie apenas em controle de acesso na camada de rede), use padrões como RBAC ou ABAC, e teste permissões explicitamente para cada nível de privilégio. Considere microsserviços isolados para funções críticas que requerem privilégios elevados.

CVE-2024-57721MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.EPSS 0.3%CVE-2024-0137MEDIUMNVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted codeEPSS 0.3%CVE-2025-12695MEDIUMInsecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandboxEPSS 0.3%CVE-2026-8401CRITICALSandbox escape in the Profile Backup componentEPSS 0.3%CVE-2023-29580MEDIUMyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.EPSS 0.3%CVE-2025-5476MEDIUMSony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass VulnerabilityEPSS 0.3%CVE-2025-46215MEDIUMAn Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 throuEPSS 0.3%CVE-2025-26393MEDIUMSolarWinds Service Desk Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-65635HIGHBoruta dynamic client registration allows creation of over-privileged OAuth clientsEPSS 0.3%CVE-2024-30388HIGHJunos OS: QFX5000 Series and EX Series: Specific malformed LACP packets will cause flapsEPSS 0.3%CVE-2026-34775MEDIUMElectron: nodeIntegrationInWorker not correctly scoped in shared renderer processesEPSS 0.3%CVE-2025-34201HIGHVasion Print (formerly PrinterLogic) Lack of Network Segmentation Between Docker InstancesEPSS 0.3%CVE-2026-62246HIGHKamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolationEPSS 0.3%CVE-2025-41116LOWIncorrect oauth passthrough in Grafana Databricks DatasourceEPSS 0.3%CVE-2025-3717LOWIncorrect oauth passthrough in Grafana Snowflake DatasourceEPSS 0.3%CVE-2026-5600MEDIUMA new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-EPSS 0.3%CVE-2026-41174MEDIUMTraefik Kubernetes CRD allows unauthorized cross-namespace middleware bindingEPSS 0.3%CVE-2024-5801MEDIUMIP Forwarding enabled in B&R Automation RuntimeEPSS 0.3%CVE-2026-4325MEDIUMKeycloak: keycloak: replay of action tokens via improper handling of single-use entriesEPSS 0.3%CVE-2026-5599HIGHAPI allows deletion of users of other instanceEPSS 0.2%