Weaknesses of type CWE-602

174 results

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega para o cliente (navegador, app, dispositivo) a responsabilidade de implementar uma proteção que deveria ser garantida no servidor. Isso é perigoso porque o cliente está sob controle do atacante — qualquer validação, restrição ou lógica de segurança implementada apenas no lado do cliente pode ser contornada, alterada ou removida. O servidor fica vulnerável quando assume que o cliente vai cumprir as regras.

Example

Um e-commerce que valida limite de quantidade de compra apenas no JavaScript do frontend, ou um banco que confere crédito disponível apenas no navegador antes de enviar a transação. Um atacante modifica o código do cliente, remove a validação ou faz requisições diretas ao servidor, contornando a proteção completamente.

How to mitigate

Implemente toda validação, autenticação e autorização críticas no servidor. Nunca confie em mecanismos de segurança executados apenas no cliente. Use validação no cliente para UX, mas sempre revalide e reforce as regras no backend antes de qualquer operação sensível.

CVE-2025-27367MEDIUMIBM OpenPages with Watson improper input validationEPSS 0.2%CVE-2026-17953MEDIUMInsufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigationEPSS 0.2%CVE-2026-14047MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a EPSS 0.2%CVE-2026-14081MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a maEPSS 0.2%CVE-2025-36102LOWIBM Controller Validation BypassEPSS 0.2%CVE-2026-17985MEDIUMInsufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a cEPSS 0.2%CVE-2026-11014MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a EPSS 0.2%CVE-2026-13894MEDIUMInsufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bEPSS 0.2%CVE-2025-14687MEDIUMClient-Side Enforcement of Server-Side Security in IBM Db2 Intelligence CenterEPSS 0.2%CVE-2026-17821MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a EPSS 0.2%CVE-2023-3747MEDIUMInsufficient Validation on Override Codes for Always-Enabled WARP ModeEPSS 0.2%CVE-2026-17960MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-refeEPSS 0.2%CVE-2026-77793MEDIUMRegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price FieldEPSS 0.2%CVE-2026-29077HIGHFrappe: Broken Access Control in DocShareEPSS 0.2%CVE-2025-36410LOWMultiple vulnerabilities found in IBM ApplinX.EPSS 0.2%CVE-2025-2138LOWIBM Engineering Requirements Management Doors Next data modificationEPSS 0.2%CVE-2025-2139LOWIBM Engineering Requirements Management Doors Next security bypassEPSS 0.2%CVE-2026-11236HIGHInsufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rEPSS 0.2%CVE-2026-11092HIGHInsufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a maEPSS 0.2%CVE-2026-42329MEDIUMIris has an Open Redirect issueEPSS 0.2%