Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-74959CRITICALMitigation bypass in the Storage: Cache API componentEPSS 0.3%CVE-2026-109737HIGHMitigation bypass in the Enterprise Policies componentEPSS 0.3%CVE-2025-12094MEDIUMOOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header SpoofingEPSS 0.3%CVE-2026-109760HIGHMitigation bypass in the Networking: HTTP componentEPSS 0.3%CVE-2026-109766HIGHMitigation bypass in the Enterprise Policies componentEPSS 0.3%CVE-2026-86894HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandboEPSS 0.3%CVE-2026-109734HIGHMitigation bypass in the DOM: Security componentEPSS 0.3%CVE-2026-79638MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 0.3%CVE-2026-109755CRITICALSandbox escape in the DOM: Content Processes componentEPSS 0.3%CVE-2026-44071LOWFORTIFY_SOURCE disabledEPSS 0.3%CVE-2026-44646MEDIUMLiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`EPSS 0.3%CVE-2020-10598—In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability eEPSS 0.3%CVE-2025-15618CRITICALBusiness::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret keyEPSS 0.3%CVE-2026-14101CRITICALInsufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the EPSS 0.3%CVE-2026-39452MEDIUMProtection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applications may allow an escaEPSS 0.3%CVE-2026-14151HIGHInappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2022-26696HIGHThis issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be ableEPSS 0.3%CVE-2026-28500HIGHONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain AttackEPSS 0.3%CVE-2026-74983HIGHMitigation bypass in the Data Loss Prevention componentEPSS 0.3%CVE-2026-100775CRITICALSandbox escape in the Graphics componentEPSS 0.3%