Weaknesses of type CWE-693

958 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2024-21423MEDIUMMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.6%CVE-2023-28286MEDIUMMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-34208CRITICALSandboxJS: Sandbox integrity escapeEPSS 0.6%CVE-2026-47686CRITICALvm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCEEPSS 0.6%CVE-2026-91949CRITICALFreeRDP 3.0.0 through 3.30.0 Protocol Negotiation BypassEPSS 0.6%CVE-2026-16356CRITICALSandbox escape due to use-after-free in the Disability Access APIs componentEPSS 0.6%CVE-2026-25115CRITICALn8n is vulnerable to Python sandbox escapeEPSS 0.6%CVE-2022-42801HIGHA logic issue was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS EPSS 0.6%CVE-2026-84809HIGHTencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python BytecodeEPSS 0.6%CVE-2020-28396—A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-80EPSS 0.6%CVE-2026-16383CRITICALMitigation bypass in the DOM: Networking componentEPSS 0.6%CVE-2026-16377CRITICALMitigation bypass in the PDF Viewer componentEPSS 0.6%CVE-2025-65319CRITICALWhen using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-WeEPSS 0.6%CVE-2026-97678HIGHLangflow OSS is affected by multiple vulnerabilitiesEPSS 0.6%CVE-2026-14535HIGHFickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()EPSS 0.6%CVE-2020-16198MEDIUMPhilips Clinical Collaboration Platform Protection Mechanism FailureEPSS 0.6%CVE-2025-71373HIGHpicklescan - Remote Code Execution via operator.methodcaller Detection BypassEPSS 0.6%CVE-2025-65318CRITICALWhen using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-WebEPSS 0.6%CVE-2022-33942HIGHProtection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalatEPSS 0.6%CVE-2026-74896CRITICALopenssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute TraversalEPSS 0.6%