Weaknesses of type CWE-602

174 results

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega para o cliente (navegador, app, dispositivo) a responsabilidade de implementar uma proteção que deveria ser garantida no servidor. Isso é perigoso porque o cliente está sob controle do atacante — qualquer validação, restrição ou lógica de segurança implementada apenas no lado do cliente pode ser contornada, alterada ou removida. O servidor fica vulnerável quando assume que o cliente vai cumprir as regras.

Example

Um e-commerce que valida limite de quantidade de compra apenas no JavaScript do frontend, ou um banco que confere crédito disponível apenas no navegador antes de enviar a transação. Um atacante modifica o código do cliente, remove a validação ou faz requisições diretas ao servidor, contornando a proteção completamente.

How to mitigate

Implemente toda validação, autenticação e autorização críticas no servidor. Nunca confie em mecanismos de segurança executados apenas no cliente. Use validação no cliente para UX, mas sempre revalide e reforce as regras no backend antes de qualquer operação sensível.

CVE-2026-13896MEDIUMInsufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions EPSS 0.3%CVE-2026-25737HIGHBudibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)EPSS 0.3%CVE-2025-36039MEDIUMIBM Aspera Faspex bypass securityEPSS 0.3%CVE-2026-39415MEDIUMFrappe Learning Management System has Client-Side Manipulation of Quiz ScoresEPSS 0.3%CVE-2025-5450MEDIUMImproper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure beEPSS 0.3%CVE-2026-30522MEDIUMA Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application EPSS 0.3%CVE-2026-77999HIGHJoomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.3%CVE-2026-82189HIGHJoomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.3%CVE-2026-14075MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-refeEPSS 0.3%CVE-2026-23859LOWDell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high priviEPSS 0.3%CVE-2026-73627MEDIUMJupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement BypassEPSS 0.2%CVE-2026-42160CRITICALData Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backendEPSS 0.2%CVE-2025-36093MEDIUMsecurity vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.EPSS 0.2%CVE-2024-39870HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured tEPSS 0.2%CVE-2024-44106HIGHInsufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local autEPSS 0.2%CVE-2025-9495HIGHViessmann Vitogate 300 Authentication BypassEPSS 0.2%CVE-2026-16480MEDIUMIBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.EPSS 0.2%CVE-2026-11287MEDIUMInsufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromisEPSS 0.2%CVE-2026-44567HIGHOpen WebUI: Open WebUI Improper Authorization ControlEPSS 0.2%CVE-2026-54047CRITICALLaci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration ManipulationEPSS 0.2%