Weaknesses of type CWE-693

959 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2024-55024HIGHAn authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorizEPSS 0.4%CVE-2026-57135HIGHPraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsEPSS 0.4%CVE-2026-45655MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-19168HIGHInappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.4%CVE-2024-6832MEDIUMAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksEPSS 0.4%CVE-2026-19150HIGHInappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.4%CVE-2026-65899MEDIUMDOMPurify before 3.4.9 Trusted Types Policy State ContaminationEPSS 0.4%CVE-2018-10631MEDIUMMedtronic N'Vision Clinician Programmer Protection Mechanism FailureEPSS 0.4%CVE-2026-117967HIGHMitigation bypass in the DOM: Security componentEPSS 0.4%CVE-2026-117998HIGHMitigation bypass in the DOM: Push Subscriptions componentEPSS 0.4%CVE-2024-0809MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions vEPSS 0.4%CVE-2026-117868CRITICALSandbox escape in the DOM: Networking componentEPSS 0.4%CVE-2025-60711MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-48808MEDIUMTwig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`EPSS 0.4%CVE-2026-20277HIGHCisco IOS XR Software Security Hardening Release: September 2026EPSS 0.4%CVE-2026-49458MEDIUMDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksEPSS 0.4%CVE-2023-45372—An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.EPSS 0.4%CVE-2020-5379MEDIUMDell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to sysEPSS 0.4%CVE-2026-90957MEDIUMMISP: Stored XSS via Inline-Served SVG Organisation Logos and Report PicturesEPSS 0.4%CVE-2026-22692MEDIUMOctober CMS: Twig Sandbox Bypass via Collection MethodsEPSS 0.4%