Weaknesses of type CWE-693

958 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-16382CRITICALMitigation bypass in the DOM: Service Workers componentEPSS 0.6%CVE-2026-57120MEDIUMPraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunderEPSS 0.6%CVE-2024-27713HIGHAn issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP ResEPSS 0.6%CVE-2026-16388CRITICALSandbox escape in the DOM: Networking componentEPSS 0.6%CVE-2026-92066CRITICALSandbox escape in the Profile Backup componentEPSS 0.6%CVE-2024-33903MEDIUMIn CARLA through 0.9.15.2, the collision sensor mishandles some situations involving pedestrians or bicycles, in part because the collision EPSS 0.5%CVE-2026-92121HIGHApache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform referenceEPSS 0.5%CVE-2026-57136HIGHPraisonAI SandboxExecutor allowedCommands bypass via shell chainingEPSS 0.5%CVE-2026-101900MEDIUMAxios: Fetch Adapter Header Injection via Inherited FormData getHeadersEPSS 0.5%CVE-2024-43645MEDIUMWindows Defender Application Control (WDAC) Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-21668HIGHA vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.EPSS 0.5%CVE-2024-43584HIGHWindows Scripting Engine Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2025-44090HIGHAn issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.EPSS 0.5%CVE-2022-39011HIGHThe HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulneEPSS 0.5%CVE-2026-94603CRITICALPodman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationEPSS 0.5%CVE-2026-33622MEDIUMA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript ExecutionEPSS 0.5%CVE-2024-0101HIGHNVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enEPSS 0.5%CVE-2025-44089HIGHAn issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.EPSS 0.5%CVE-2024-23499HIGHProtection mechanism failure in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before versEPSS 0.5%CVE-2026-76827MEDIUMSearch-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)EPSS 0.5%