Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-108588MEDIUMMultiple vulnerabilities that affects IBM Db2 Genius HubEPSS 0.2%CVE-2026-28914MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.EPSS 0.2%CVE-2026-112434HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. AEPSS 0.2%CVE-2026-11288MEDIUMInsufficient policy enforcement in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%CVE-2025-46358HIGHEmerson ValveLink Products Protection Mechanism FailureEPSS 0.2%CVE-2026-61437HIGHPraisonAI before 1.6.78 Remote Code Execution via tools.pyEPSS 0.2%CVE-2026-86936HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. AEPSS 0.2%CVE-2025-31244HIGHA file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out ofEPSS 0.2%CVE-2026-7959LOWInappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the rendereEPSS 0.2%CVE-2026-22707MEDIUMStrapi Upload Plugin MIME Validation Bypass via Content APIEPSS 0.2%CVE-2021-33081HIGHProtection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disEPSS 0.2%CVE-2024-20284MEDIUMCisco NX-OS Software Python Parser Escape VulnerabilityEPSS 0.2%CVE-2024-20286MEDIUMCisco NX-OS Software Python Parser Escape VulnerabilityEPSS 0.2%CVE-2026-82474HIGHSudo through 1.9.17p2 Intercept Policy Bypass via execveatEPSS 0.2%CVE-2025-59849MEDIUMHCL BigFix Remote Control is vulnerable to an insecure CSP configurationEPSS 0.2%CVE-2025-54991MEDIUMJupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)EPSS 0.2%CVE-2026-17776MEDIUMPolicy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poteEPSS 0.2%CVE-2026-79298HIGHAn issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrarEPSS 0.2%CVE-2026-12031HIGHInappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the EPSS 0.2%CVE-2025-48571MEDIUMIn multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. ThiEPSS 0.2%