Weaknesses of type CWE-693

836 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-45655MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2018-10631MEDIUMMedtronic N'Vision Clinician Programmer Protection Mechanism FailureEPSS 0.4%CVE-2024-0809MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions vEPSS 0.4%CVE-2026-74895CRITICALopenssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process IsolationEPSS 0.4%CVE-2026-48808MEDIUMTwig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`EPSS 0.4%CVE-2026-49458MEDIUMDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksEPSS 0.4%CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.4%CVE-2026-6876CRITICALSandbox Escape in ServiceNow AI PlatformEPSS 0.4%CVE-2026-66391MEDIUMApache Wicket: leaked and missing CSP headersEPSS 0.4%CVE-2026-92956CRITICALvm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreamingEPSS 0.4%CVE-2025-37124HIGHUnauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge InterfaceEPSS 0.4%CVE-2020-5379MEDIUMDell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to sysEPSS 0.4%CVE-2026-22692MEDIUMOctober CMS: Twig Sandbox Bypass via Collection MethodsEPSS 0.4%CVE-2026-2761CRITICALSandbox escape in the Graphics: WebRender componentEPSS 0.4%CVE-2026-46639HIGHTwig: Sandbox property and method bypass via object-destructuring assignmentEPSS 0.4%CVE-2026-16356CRITICALSandbox escape due to use-after-free in the Disability Access APIs componentEPSS 0.4%CVE-2026-57138CRITICALPraisonAI codeMode sandbox escape via Function constructorEPSS 0.4%CVE-2026-43787MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attaEPSS 0.4%CVE-2026-12296CRITICALSandbox escape in the Security: Process Sandboxing componentEPSS 0.4%CVE-2026-30938MEDIUMParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementEPSS 0.4%