Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2019-13535MEDIUMMedtronic Valleylab FT10 and LS10 Protection Mechanism FailureEPSS 0.4%CVE-2026-49459MEDIUMDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMEPSS 0.4%CVE-2026-109780CRITICALMitigation bypass in the DOM: Core & HTML componentEPSS 0.4%CVE-2026-12294CRITICALSandbox escape in the DOM: Workers componentEPSS 0.4%CVE-2024-20438MEDIUMCisco Nexus Dashboard Fabric Controller Unauthorized REST API VulnerabilityEPSS 0.4%CVE-2026-14409HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in speciEPSS 0.4%CVE-2026-105668HIGHHex release-age cooldown is lifted package-wide when the locked release is retiredEPSS 0.4%CVE-2026-49981MEDIUMTwig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`EPSS 0.4%CVE-2026-76528CRITICALProtection Mechanism Failure in Splunk SOAREPSS 0.4%CVE-2026-79918MEDIUMMaxKB: Sandbox escape via unhooked fexecveEPSS 0.4%CVE-2022-48287HIGHThe HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data integrity.EPSS 0.4%CVE-2025-11260MEDIUMWP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism BypassEPSS 0.4%CVE-2026-47139HIGHvm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_serverEPSS 0.4%CVE-2026-52873MEDIUMStreambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron RendererEPSS 0.4%CVE-2026-112361MEDIUMDolibarr CSP document.php protection mechanismEPSS 0.4%CVE-2026-53949MEDIUMGhost Content API filter bypass reveals private fieldsEPSS 0.4%CVE-2026-113952MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2EPSS 0.4%CVE-2025-14304HIGHASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism FailureEPSS 0.4%CVE-2025-43728CRITICALDell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remotEPSS 0.4%CVE-2025-14302HIGHGIGABYTE｜Motherboard - Protection Mechanism FailureEPSS 0.3%