Weaknesses of type CWE-602

185 results

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega para o cliente (navegador, app, dispositivo) a responsabilidade de implementar uma proteção que deveria ser garantida no servidor. Isso é perigoso porque o cliente está sob controle do atacante — qualquer validação, restrição ou lógica de segurança implementada apenas no lado do cliente pode ser contornada, alterada ou removida. O servidor fica vulnerável quando assume que o cliente vai cumprir as regras.

Example

Um e-commerce que valida limite de quantidade de compra apenas no JavaScript do frontend, ou um banco que confere crédito disponível apenas no navegador antes de enviar a transação. Um atacante modifica o código do cliente, remove a validação ou faz requisições diretas ao servidor, contornando a proteção completamente.

How to mitigate

Implemente toda validação, autenticação e autorização críticas no servidor. Nunca confie em mecanismos de segurança executados apenas no cliente. Use validação no cliente para UX, mas sempre revalide e reforce as regras no backend antes de qualquer operação sensível.

CVE-2026-17985MEDIUMInsufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a cEPSS 0.3%CVE-2026-17953MEDIUMInsufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigationEPSS 0.3%CVE-2026-17805MEDIUMInsufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation reEPSS 0.3%CVE-2026-17703MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigatEPSS 0.3%CVE-2026-17813MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigatEPSS 0.3%CVE-2026-17756MEDIUMInsufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrEPSS 0.3%CVE-2025-12115HIGHWPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price AlterationEPSS 0.3%CVE-2026-56256HIGHCapgo - Two-Factor Authentication Bypass via Organization Management APIEPSS 0.3%CVE-2026-14054MEDIUMInsufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictioEPSS 0.3%CVE-2026-77320MEDIUMTREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)EPSS 0.3%CVE-2025-10161HIGHAuthentication Bypass in Turkguven's PerfektiveEPSS 0.3%CVE-2026-117554MEDIUMAdmidio before 5.0.17 Event Guest Restriction Bypass via events_function.phpEPSS 0.3%CVE-2026-23859LOWDell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high priviEPSS 0.3%CVE-2026-11025MEDIUMInsufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass contentEPSS 0.3%CVE-2026-11018MEDIUMInsufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictionsEPSS 0.3%CVE-2024-6620LOWHoneywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. A(n) attacker couEPSS 0.3%CVE-2026-13724MEDIUMBusiness Logic Bypass in Gobito's Corporate Training Management SystemEPSS 0.3%CVE-2026-13795MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigatEPSS 0.3%CVE-2026-39415MEDIUMFrappe Learning Management System has Client-Side Manipulation of Quiz ScoresEPSS 0.3%CVE-2025-27367MEDIUMIBM OpenPages with Watson improper input validationEPSS 0.3%