Weaknesses of type CWE-693

836 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-21668HIGHA vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.EPSS 0.5%CVE-2017-3893LOWIncomplete vulnerability mitigationsEPSS 0.5%CVE-2021-32729LOWA user without PR can reset user authentication failures informationEPSS 0.5%CVE-2024-0682MEDIUMPage Restrict <= 2.5.5 - Protection Mechanism BypassEPSS 0.5%CVE-2024-0804HIGHInsufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin daEPSS 0.5%CVE-2026-17669CRITICALInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perfoEPSS 0.5%CVE-2024-43585MEDIUMCode Integrity Guard Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-48546HIGHKanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjsEPSS 0.5%CVE-2026-39420MEDIUMMaxKB: Sandbox escape via LD_PRELOAD bypassEPSS 0.5%CVE-2026-59854MEDIUMSiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspaceEPSS 0.5%CVE-2026-48805MEDIUMTwig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`EPSS 0.5%CVE-2025-54143CRITICALSandboxed iframes could allow local downloads despite sandbox restrictionsEPSS 0.5%CVE-2026-50661MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2024-25091CRITICALProtection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' featEPSS 0.5%CVE-2026-0877HIGHMitigation bypass in the DOM: Security componentEPSS 0.5%CVE-2026-17677HIGHInappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a EPSS 0.5%CVE-2026-17710CRITICALInappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeEPSS 0.5%CVE-2026-17676CRITICALInappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rEPSS 0.5%CVE-2026-17695CRITICALInappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandEPSS 0.5%CVE-2025-66204MEDIUMWBCE CMS allows brute-force protection bypass using X-Forwarded-For headerEPSS 0.5%