Weaknesses of type CWE-693

959 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-30938MEDIUMParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementEPSS 0.5%CVE-2026-75874CRITICALSandbox escape in the Remote Settings Client componentEPSS 0.5%CVE-2026-16760HIGHFickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callablesEPSS 0.5%CVE-2018-0250—A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 18EPSS 0.5%CVE-2026-79988HIGHAuthenticated RCE through Twig sandbox escapeEPSS 0.5%CVE-2026-48037MEDIUMHulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub postureEPSS 0.5%CVE-2026-92959HIGHvm2 before 3.11.8 allowAsync Bypass via Promise ThenableEPSS 0.4%CVE-2026-59207HIGHn8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP ConnectorEPSS 0.4%CVE-2026-29649CRITICALNEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectlEPSS 0.4%CVE-2026-39353CRITICALInvoicePlane: Remote Code Execution via Writable Templates DirectoryEPSS 0.4%CVE-2026-67427HIGHFlyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylistedEPSS 0.4%CVE-2022-48290CRITICALThe phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiEPSS 0.4%CVE-2025-34413HIGHLegality WHISTLEBLOWING Missing Critical HTTP Security HeadersEPSS 0.4%CVE-2026-87808HIGHSiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlockEPSS 0.4%CVE-2026-74938CRITICALMitigation bypass in the JavaScript: GC componentEPSS 0.4%CVE-2026-92778MEDIUMCMAK through 3.0.0.6 Feature Gate Bypass via HTML Form RoutesEPSS 0.4%CVE-2026-2768CRITICALSandbox escape in the Storage: IndexedDB componentEPSS 0.4%CVE-2026-77892MEDIUMWindows Boot Manager Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-8811HIGHWinZip Mark-of-the-Web Bypass VulnerabilityEPSS 0.4%CVE-2026-20701HIGHAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS EPSS 0.4%