Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-14625MEDIUMNousResearch hermes-agent server.py shell.exec protection mechanismEPSS 0.4%CVE-2026-13859CRITICALInappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escEPSS 0.4%CVE-2026-41510HIGHOWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingEPSS 0.4%CVE-2025-52951MEDIUMJunos OS: IPv6 firewall filter fails to match payload-protocolEPSS 0.4%CVE-2025-8032HIGHXSLT documents could bypass CSPEPSS 0.4%CVE-2018-11459—A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versEPSS 0.4%CVE-2018-11460—A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versEPSS 0.4%CVE-2023-32644MEDIUMProtection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unaEPSS 0.4%CVE-2026-64728MEDIUMA permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, EPSS 0.4%CVE-2026-8962HIGHMitigation bypass in the DOM: Security componentEPSS 0.4%CVE-2026-44982HIGHCrowdSec AppSec silently drops request body for chunked / HTTP-2 requestsEPSS 0.4%CVE-2026-45459LOWMicrosoft Excel Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2025-65100MEDIUMSecurity Snapshot May Use Unintended Timestamp When Only ISAR_APT_SNAPSHOT_DATE Is SetEPSS 0.4%CVE-2025-10528HIGHSandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D componentEPSS 0.4%CVE-2026-8945HIGHSandbox escape in Firefox and Firefox Focus for AndroidEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%CVE-2025-6427CRITICALconnect-src Content Security Policy restriction could be bypassedEPSS 0.4%CVE-2026-4447HIGHInappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.4%CVE-2026-48807HIGHTwig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filtersEPSS 0.4%CVE-2025-55886MEDIUMAn Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment hisEPSS 0.4%