Weaknesses of type CWE-358

119 results

Verificação de Segurança Incompleta ou Inadequada

A aplicação implementa uma validação de segurança, mas ela é insuficiente, incompleta ou contornável — deixando brechas que um atacante consegue explorar. O código tenta proteger, mas falha em cobrir todos os cenários ou não valida corretamente, permitindo acesso não autorizado ou execução maliciosa.

Example

Um sistema valida se o usuário está autenticado antes de acessar um recurso, mas não verifica se ele tem permissão específica para aquele recurso; ou uma API verifica o token JWT, mas não valida a assinatura corretamente, permitindo tokens falsificados.

How to mitigate

Implemente validações em múltiplas camadas (autenticação + autorização), revise a lógica de segurança com testes de contorno, use bibliotecas consolidadas (OAuth 2.0, OWASP ESAPI) e realize code review focado em edge cases e cenários de bypass.

CVE-2026-1486HIGHOrg.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grantEPSS 0.5%CVE-2021-42017MEDIUMA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUEPSS 0.5%CVE-2025-25255MEDIUMAn Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiPrEPSS 0.4%CVE-2026-96760CRITICALAuthlib library contains a signature‑verification bypass vulnerabilityEPSS 0.4%CVE-2026-12577HIGHDVP80ES3 Improperly Implemented Security Check for Standard vulnerabilityEPSS 0.4%CVE-2024-55599MEDIUMAn Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all verEPSS 0.4%CVE-2026-65058MEDIUMTrezor Safe improper security check in on-device displayEPSS 0.4%CVE-2025-10457MEDIUMBluetooth: Out-Of-Context le_conn_rsp HandlingEPSS 0.4%CVE-2021-21387HIGHPartial secret key disclosure, improper safety number calculation, & inadequate encryption strengthEPSS 0.4%CVE-2025-3069HIGHInappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalationEPSS 0.4%CVE-2024-36511LOWAn improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4EPSS 0.4%CVE-2023-39403CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2025-62585HIGHWhale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.EPSS 0.4%CVE-2025-59147HIGHSuricata is Vulnerable to Detection Bypass via Crafted Multiple SYN PacketsEPSS 0.4%CVE-2025-66600HIGHA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS (HTTP Strict Transport SeEPSS 0.4%CVE-2024-12056LOWClient Secret not checked with OAuth Password grant typeEPSS 0.4%CVE-2025-13333MEDIUMIBM WebSphere Application Server could provide weaker than expected securityEPSS 0.4%CVE-2024-3838MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicEPSS 0.3%CVE-2026-49783HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2025-49011LOWSpiceDB checks involving relations with caveats can result in no permission when permission is expectedEPSS 0.3%