Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-110866MEDIUMRenovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase RequestEPSS 0.2%CVE-2026-12438HIGHInappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised thEPSS 0.2%CVE-2026-57144HIGHPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableEPSS 0.2%CVE-2026-11174MEDIUMInappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renEPSS 0.2%CVE-2025-55002MEDIUMJupyterLab Desktop: TCC Bypass via Misconfigured Node FusesEPSS 0.2%CVE-2025-55249LOWHCL AION is affected by a Missing Security Response Headers vulnerability.EPSS 0.2%CVE-2025-46281HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An appEPSS 0.2%CVE-2026-17659MEDIUMInappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendEPSS 0.2%CVE-2024-45835LOWInsufficient Electron Fuses ConfigurationEPSS 0.2%CVE-2026-41469MEDIUMBeghelli Sicuro24 SicuroWeb Missing Content Security PolicyEPSS 0.2%CVE-2025-12909MEDIUMInsufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via EPSS 0.2%CVE-2026-18015CRITICALInappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbEPSS 0.2%CVE-2026-86937MEDIUMA logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS TahoeEPSS 0.2%CVE-2026-0017HIGHIn onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could leadEPSS 0.2%CVE-2026-105991LOWMultiple vulnerabilities that affects IBM Db2 Genius HubEPSS 0.2%CVE-2026-92039MEDIUMMitigation bypass in the DOM: Notifications componentEPSS 0.2%CVE-2026-44000MEDIUMvm2: sandbox boundary bypass via host Promise resolution preserving host object identityEPSS 0.2%CVE-2025-46291MEDIUMA logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.2. An app may bypass GatekEPSS 0.2%CVE-2026-7946MEDIUMInsufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker EPSS 0.2%CVE-2025-31189HIGHA file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturaEPSS 0.2%