Falhas do tipo CWE-749

174 resultados

Exposição de método ou função perigosa

Quando uma aplicação disponibiliza publicamente um método ou função que não deveria ser acessível, permitindo que atacantes a executem com consequências graves. O problema é expor funcionalidades sensíveis (como deleção de dados, mudança de permissões ou acesso a recursos críticos) sem validação adequada de quem está chamando.

Exemplo

Uma API REST expõe um endpoint `/admin/deleteUser` sem autenticação ou apenas com verificação de token fraco, permitindo qualquer pessoa deletar usuários da plataforma. Ou uma biblioteca carrega um método de configuração interna que permite alterar parâmetros de segurança diretamente via reflexão.

Como mitigar

Aplique princípio do menor privilégio: mantenha métodos sensíveis privados ou protegidos, exporte apenas o necessário e força autenticação + autorização rigorosa em tudo que fica acessível. Implemente validação de entrada e auditoria de quem acessa recursos críticos.

CVE-2021-34996HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authEPSS 82.3%CVE-2010-0738MEDIUMThe JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 aEPSS 79.4%KEVCVE-2018-10931CRITICALIt was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker EPSS 67.9%CVE-2010-1428HIGHThe Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09EPSS 62.3%KEVCVE-2023-38124HIGHInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 59.6%CVE-2006-1547HIGHActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service vEPSS 54.6%KEVCVE-2023-27363HIGHFoxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 47.0%CVE-2023-51573CRITICALVoltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass VulnerabilityEPSS 45.7%CVE-2026-22812HIGHOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command ExecutionEPSS 17.0%CVE-2021-28809CRITICALMissing Authentication for Critical Function in RTRR Server in HBS3EPSS 15.8%CVE-2023-49074HIGHA denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.EPSS 13.5%CVE-2020-15623CRITICALThis vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthentEPSS 8.3%CVE-2020-17388HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougEPSS 7.5%CVE-2021-42128—An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via EEPSS 4.5%CVE-2014-5415CRITICALBeckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or FunctionEPSS 4.3%CVE-2021-26614HIGHIpTime C200 IP camera remote code execution vulnerabilityEPSS 2.5%CVE-2016-9469—Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequesEPSS 2.4%CVE-2023-44414CRITICALD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.4%CVE-2025-26651MEDIUMWindows Local Session Manager (LSM) Denial of Service VulnerabilityEPSS 2.3%CVE-2023-38097HIGHNETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.1%