Weaknesses of type CWE-693

959 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-84810HIGHclaude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory ScanEPSS 0.5%CVE-2026-45697CRITICALFormie: Pre-authenticated server-side template injection in Hidden fieldsEPSS 0.5%CVE-2022-46762HIGHThe memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.EPSS 0.5%CVE-2026-2761CRITICALSandbox escape in the Graphics: WebRender componentEPSS 0.5%CVE-2026-54694CRITICALNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverEPSS 0.5%CVE-2026-46638MEDIUMTwig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)EPSS 0.5%CVE-2026-0877HIGHMitigation bypass in the DOM: Security componentEPSS 0.5%CVE-2019-5024HIGHA restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical informaEPSS 0.5%CVE-2026-74790CRITICALScriban before 7.0.0 MemberFilter Bypass via TemplateContext CacheEPSS 0.5%CVE-2026-77401MEDIUMZope AccessControl: Information disclosure through Python string `format` and `format_map` functionsEPSS 0.5%CVE-2026-47305HIGHVisual Studio Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-54981HIGHVisual Studio Code Python Extension Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-34072HIGHcronmaster: Middleware authentication bypass enabling unauthorized page access and server-action executionEPSS 0.5%CVE-2024-13794MEDIUMHide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page DisclosureEPSS 0.5%CVE-2021-31608MEDIUMProofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.EPSS 0.5%CVE-2026-55366CRITICALIn IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalationEPSS 0.5%CVE-2026-55376HIGHheym Python Tool Sandbox EscapeEPSS 0.5%CVE-2023-52378CRITICALVulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause featureEPSS 0.5%CVE-2026-106439HIGHHydra: Mutable instantiate policy sets allow target blocklist bypassEPSS 0.5%CVE-2026-3965MEDIUMwhyour qinglong API express.ts protection mechanismEPSS 0.5%