Weaknesses of type CWE-693

958 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2025-48003MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2024-28248HIGHCilium intermittent HTTP policy bypassEPSS 0.6%CVE-2023-4466LOWPoly CCX 400/CCX 600/Trio 8800/Trio C60 Web Interface protection mechanismEPSS 0.6%CVE-2026-92938CRITICALvm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqliteEPSS 0.6%CVE-2023-0141MEDIUMInsufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crEPSS 0.6%CVE-2026-46634HIGHTwig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template nameEPSS 0.6%CVE-2024-33883MEDIUMThe ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.EPSS 0.6%CVE-2024-20669MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2024-28919MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2023-0131MEDIUMInappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download EPSS 0.6%CVE-2024-0681MEDIUMPage Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism BypassEPSS 0.6%CVE-2025-3114CRITICALSpotfire Code Execution VulnerabilityEPSS 0.6%CVE-2026-97673HIGHLangflow OSS is affected by multiple vulnerabilitiesEPSS 0.6%CVE-2024-0680MEDIUMWP Private Content Plus <= 3.6 - Protection Mechanism BypassEPSS 0.6%CVE-2024-20923LOWVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions thEPSS 0.6%CVE-2024-0747MEDIUMWhen a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child ContEPSS 0.6%CVE-2026-16916CRITICALSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.6%CVE-2022-41979MEDIUMProtection mechanism failure in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalatioEPSS 0.6%CVE-2026-82855CRITICAL@hulumi/policies before 1.3.2 Evidence Validation BypassEPSS 0.6%CVE-2026-61792HIGHWeblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)EPSS 0.6%