Weaknesses of type CWE-693

958 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2025-71352HIGHpicklescan - Remote Code Execution via Undetected trace.Trace.runctx in Pickle FilesEPSS 0.7%CVE-2024-28920HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2021-31386MEDIUMJunos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.EPSS 0.7%CVE-2026-93606CRITICALvm2 before 3.12.1 Sandbox Escape via Promise Symbol.speciesEPSS 0.7%CVE-2026-26332CRITICALvm2: Sandbox EscapeEPSS 0.7%CVE-2024-38070HIGHWindows LockDown Policy (WLDP) Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2025-50327HIGHAn issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypEPSS 0.7%CVE-2025-21384HIGHAzure Health Bot Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2025-21346HIGHMicrosoft Office Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2023-0085MEDIUMMetform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection BypassEPSS 0.7%CVE-2020-15215MEDIUMContext isolation bypass in ElectronEPSS 0.7%CVE-2024-38203MEDIUMWindows Package Library Manager Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-74895CRITICALopenssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process IsolationEPSS 0.7%CVE-2026-6876CRITICALSandbox Escape in ServiceNow AI PlatformEPSS 0.7%CVE-2025-48800MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2025-43273CRITICALA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.8. A sandEPSS 0.7%CVE-2022-43432MEDIUMJenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content iEPSS 0.7%CVE-2025-27665CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection aEPSS 0.7%CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.7%CVE-2025-50324HIGHAn issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.EPSS 0.7%