Weaknesses of type CWE-693

959 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-22692MEDIUMOctober CMS: Twig Sandbox Bypass via Collection MethodsEPSS 0.4%CVE-2026-46639HIGHTwig: Sandbox property and method bypass via object-destructuring assignmentEPSS 0.4%CVE-2026-73288MEDIUMRustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deletedEPSS 0.4%CVE-2026-113730MEDIUMOGNL stricter-invocation block list bypass via java.lang.reflect reflection proxiesEPSS 0.4%CVE-2026-16356CRITICALSandbox escape due to use-after-free in the Disability Access APIs componentEPSS 0.4%CVE-2026-12296CRITICALSandbox escape in the Security: Process Sandboxing componentEPSS 0.4%CVE-2026-12295CRITICALSandbox escape in the DOM: Navigation componentEPSS 0.4%CVE-2023-5875LOWLack of Hardening against media exploitation from a remote originEPSS 0.4%CVE-2026-117864HIGHSandbox escape in the Form Manager componentEPSS 0.4%CVE-2026-117861CRITICALSandbox escape in the DOM: Navigation componentEPSS 0.4%CVE-2026-16383CRITICALMitigation bypass in the DOM: Networking componentEPSS 0.4%CVE-2026-16377CRITICALMitigation bypass in the PDF Viewer componentEPSS 0.4%CVE-2024-24983HIGHProtection mechanism failure in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 4.4 may alloEPSS 0.4%CVE-2026-78552MEDIUMValidation Bypass in Okta Access Gateway Custom DirectivesEPSS 0.4%CVE-2026-79919MEDIUMMaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)EPSS 0.4%CVE-2025-71322HIGHPickleScan - Unsafe Globals Check Bypass via pty.spawn FunctionEPSS 0.4%CVE-2026-59223MEDIUMOpen WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matchingEPSS 0.4%CVE-2023-27383MEDIUMProtection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a pEPSS 0.4%CVE-2026-76301CRITICALSecurity Hardening in Splunk Enterprise - October 2026EPSS 0.4%CVE-2026-14625MEDIUMNousResearch hermes-agent server.py shell.exec protection mechanismEPSS 0.4%