Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-100775CRITICALSandbox escape in the Graphics componentEPSS 0.3%CVE-2025-49193MEDIUMMissing HTTP Security HeadersEPSS 0.3%CVE-2026-69278HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2020-3458MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000/2100 Series Appliances Secure Boot Bypass VulnerabilitiesEPSS 0.3%CVE-2025-64763LOWEnvoy forwards early CONNECT data in TCP proxy modeEPSS 0.3%CVE-2026-17079MEDIUMIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-104774MEDIUMOWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassEPSS 0.3%CVE-2026-20702HIGHProtection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. UnprivilEPSS 0.3%CVE-2026-107697MEDIUMFFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()EPSS 0.3%CVE-2026-106016CRITICALMitigation bypass in the File Handling componentEPSS 0.3%CVE-2026-14097CRITICALInappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised EPSS 0.3%CVE-2026-45656HIGHUEFI Secure Boot Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-13910MEDIUMInsufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dEPSS 0.3%CVE-2026-14059MEDIUMInsufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origEPSS 0.3%CVE-2026-14050MEDIUMInsufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%CVE-2026-32947MEDIUMEgress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)EPSS 0.3%CVE-2026-16390CRITICALMitigation bypass in the Enterprise Policies componentEPSS 0.3%CVE-2019-19278—A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-..EPSS 0.3%CVE-2026-92041CRITICALMitigation bypass in the DOM: Networking componentEPSS 0.3%CVE-2026-92075CRITICALMitigation bypass in the Networking componentEPSS 0.3%