Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-17923MEDIUMPolicy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafteEPSS 0.3%CVE-2026-60166LOWVulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploitEPSS 0.3%CVE-2026-109783HIGHMitigation bypass in the File Handling componentEPSS 0.3%CVE-2026-109782HIGHMitigation bypass in the File Handling componentEPSS 0.3%CVE-2026-114614LOWAuthlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsEPSS 0.3%CVE-2025-8656MEDIUMKenwood DMX958XR Protection Mechanism Failure Software Downgrade VulnerabilityEPSS 0.3%CVE-2026-5903MEDIUMPolicy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific EPSS 0.3%CVE-2026-3472LOWMarkdown image rendering bypass in AI bot tool result posts in MattermostEPSS 0.3%CVE-2026-110181MEDIUMPostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized dataEPSS 0.3%CVE-2026-43660HIGHA validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS EPSS 0.3%CVE-2020-7277MEDIUMMcAfee processes not protectedEPSS 0.3%CVE-2026-58883HIGHIn multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service wEPSS 0.3%CVE-2026-45102CRITICALOneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursionEPSS 0.3%CVE-2026-60086MEDIUMPraisonAI before 4.6.78 Prompt Injection Defense BypassEPSS 0.3%CVE-2026-47135HIGHvm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checksEPSS 0.3%CVE-2026-28627MEDIUMIn btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote inEPSS 0.3%CVE-2026-14120CRITICALInappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer EPSS 0.3%CVE-2026-13904MEDIUMInappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation EPSS 0.3%CVE-2026-39421MEDIUMMaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotectEPSS 0.3%CVE-2026-13886MEDIUMInsufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content secEPSS 0.3%