Weaknesses of type CWE-693

959 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-54762MEDIUMTraefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution failsEPSS 0.4%CVE-2025-62453MEDIUMGitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-45733HIGHTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appEPSS 0.4%CVE-2026-80198HIGHKimai before 2.56.0 Information Disclosure via config() Twig FunctionEPSS 0.4%CVE-2026-16370CRITICALMitigation bypass in the DOM: Networking componentEPSS 0.4%CVE-2026-16394CRITICALMitigation bypass in the DOM: Security componentEPSS 0.4%CVE-2026-16406CRITICALMitigation bypass in the Networking componentEPSS 0.4%CVE-2026-70608HIGHElectron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathEPSS 0.4%CVE-2025-47159HIGHWindows Virtualization-Based Security (VBS) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2020-6977—A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs cEPSS 0.4%CVE-2026-73217HIGHCursor: Sandbox escape via tampered Python virtual environmentsEPSS 0.4%CVE-2026-45595MEDIUMWindows Mark of the Web Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2021-31362MEDIUMJunos OS and Junos OS Evolved: An IS-IS adjacency might be taken down if a bad hello PDU is received for an existing adjacency causing a DoSEPSS 0.4%CVE-2017-6261HIGHNVIDIA’s Vibrante Linux version 1.1, 2.0, and 2.2 contains a vulnerability in the user space driver in which protection mechanisms are insufficient, may lead to denial of service or information disclosureEPSS 0.4%CVE-2026-48806HIGHTwig: Sandbox `__toString()` policy bypass via dynamic mapping keysEPSS 0.4%CVE-2022-32802HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. ProcessinEPSS 0.4%CVE-2024-11197MEDIUMLock User Account <= 1.0.5 - User Lock BypassEPSS 0.4%CVE-2026-15618MEDIUMmosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanismEPSS 0.4%CVE-2026-8959CRITICALSandbox escape due to incorrect boundary conditions in the Widget: Win32 componentEPSS 0.4%CVE-2025-37124HIGHUnauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge InterfaceEPSS 0.4%