Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2024-24562MEDIUMSecurity headers not set in vantage6-UIEPSS 0.3%CVE-2025-14303HIGHMSI｜Motherboard - Protection Mechanism FailureEPSS 0.3%CVE-2020-3455MEDIUMCisco FXOS Software for Firepower 4100/9300 Series Appliances Secure Boot Bypass VulnerabilityEPSS 0.3%CVE-2026-0881CRITICALSandbox escape in the Messaging System componentEPSS 0.3%CVE-2022-4100MEDIUMWP Cerber Security <= 9.4 - IP Protection BypassEPSS 0.3%CVE-2026-53853HIGHOpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOSEPSS 0.3%CVE-2026-13342MEDIUMSecurity Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_passwordEPSS 0.3%CVE-2024-45833MEDIUMMobile password gets saved in dictionary under conditionsEPSS 0.3%CVE-2026-90950MEDIUMPaid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration FormEPSS 0.3%CVE-2026-17865CRITICALInappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendEPSS 0.3%CVE-2026-86800MEDIUMWP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility CheckEPSS 0.3%CVE-2026-14017CRITICALInappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-17856CRITICALInappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renEPSS 0.3%CVE-2026-13909CRITICALInsufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderEPSS 0.3%CVE-2026-17669CRITICALInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perfoEPSS 0.3%CVE-2022-32537MEDIUMMedtronic MiniMed 600 Series Pump System Communication IssueEPSS 0.3%CVE-2026-17710CRITICALInappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeEPSS 0.3%CVE-2026-14037CRITICALInsufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer prEPSS 0.3%CVE-2026-86796MEDIUMWP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request ParametersEPSS 0.3%CVE-2026-8958HIGHInformation disclosure, sandbox escape in the Security: Process Sandboxing componentEPSS 0.3%