Weaknesses of type CWE-693

959 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-16407CRITICALMitigation bypass in the DOM: Service Workers componentEPSS 0.5%CVE-2026-57280HIGHJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed foEPSS 0.5%CVE-2026-101899MEDIUMAxios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesEPSS 0.5%CVE-2026-114139CRITICALSentry-Javascript: Middleware Bypass when using Tunnel routeEPSS 0.5%CVE-2026-92956CRITICALvm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreamingEPSS 0.5%CVE-2025-9866HIGHInappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security poliEPSS 0.5%CVE-2026-57137HIGHPraisonAI AgentLoop onToolCall approval runs after tool executionEPSS 0.5%CVE-2025-50325MEDIUMBandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-WEPSS 0.5%CVE-2026-100676HIGHstoatchat before 0.15.5 Local Filesystem Read via SVGEPSS 0.5%CVE-2026-39888CRITICALPraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)EPSS 0.5%CVE-2026-53508MEDIUMoasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)EPSS 0.5%CVE-2017-3893LOWIncomplete vulnerability mitigationsEPSS 0.5%CVE-2021-32729LOWA user without PR can reset user authentication failures informationEPSS 0.5%CVE-2026-41508MEDIUMOWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingEPSS 0.5%CVE-2024-0682MEDIUMPage Restrict <= 2.5.5 - Protection Mechanism BypassEPSS 0.5%CVE-2026-79684HIGHDell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploEPSS 0.5%CVE-2026-79686HIGHDell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploEPSS 0.5%CVE-2024-0804HIGHInsufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin daEPSS 0.5%CVE-2026-79683HIGHDell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploEPSS 0.5%CVE-2026-17676CRITICALInappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rEPSS 0.5%