Weaknesses of type CWE-693

836 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-60166LOWVulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploitEPSS 0.3%CVE-2026-50564CRITICALFission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escapeEPSS 0.3%CVE-2026-3472LOWMarkdown image rendering bypass in AI bot tool result posts in MattermostEPSS 0.3%CVE-2026-44646MEDIUMLiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`EPSS 0.3%CVE-2026-43660HIGHA validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS EPSS 0.3%CVE-2020-7277MEDIUMMcAfee processes not protectedEPSS 0.3%CVE-2026-79918MEDIUMMaxKB: Sandbox escape via unhooked fexecveEPSS 0.3%CVE-2026-45102CRITICALOneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursionEPSS 0.3%CVE-2026-65899MEDIUMDOMPurify before 3.4.9 Trusted Types Policy State ContaminationEPSS 0.3%CVE-2026-47135HIGHvm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checksEPSS 0.3%CVE-2026-13886MEDIUMInsufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content secEPSS 0.3%CVE-2026-13904MEDIUMInappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation EPSS 0.3%CVE-2026-39421MEDIUMMaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotectEPSS 0.3%CVE-2024-44122HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7.1, macOS EPSS 0.3%CVE-2026-84810HIGHclaude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory ScanEPSS 0.3%CVE-2026-5903MEDIUMPolicy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific EPSS 0.3%CVE-2024-39836MEDIUMMunged email address used for password resets and notificationsEPSS 0.3%CVE-2026-47676MEDIUMHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsEPSS 0.3%CVE-2026-48037MEDIUMHulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub postureEPSS 0.3%CVE-2026-2803HIGHInformation disclosure, mitigation bypass in the Settings UI componentEPSS 0.3%