Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-11684LOWInsufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utilitEPSS 0.2%CVE-2024-38660LOWProtection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially eEPSS 0.2%CVE-2026-17919MEDIUMInsufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege eEPSS 0.2%CVE-2025-71424MEDIUMEdgeless Systems Contrast before 1.9.1 Insecure Volume MountEPSS 0.2%CVE-2026-8014MEDIUMInappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2026-8011MEDIUMInsufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a EPSS 0.2%CVE-2026-5896MEDIUMPolicy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestuEPSS 0.2%CVE-2026-15528MEDIUMlamaalrajih kicad-mcp path_validator.py protection mechanismEPSS 0.2%CVE-2025-67460HIGHZoom Rooms for Windows - Software Downgrade Protection Mechanism FailureEPSS 0.2%CVE-2026-28707MEDIUMProtection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. UEPSS 0.2%CVE-2026-102539MEDIUMSuper Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is setEPSS 0.2%CVE-2025-52609LOWHCL iControl was affected by Missing Security Headers vulnerability.EPSS 0.2%CVE-2026-84559MEDIUMA permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.EPSS 0.2%CVE-2026-49325MEDIUMIndian Scout Bobber 2025 WCM voltage-based shutdownEPSS 0.2%CVE-2026-0293MEDIUMPrisma Access Agent: Anti-Tamper Protection Bypass on WindowsEPSS 0.2%CVE-2026-54577LOWmport audit can inspect the wrong package when options are presentEPSS 0.2%CVE-2026-8572LOWInsufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromisedEPSS 0.2%CVE-2026-104025HIGHPath traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry nameEPSS 0.2%CVE-2023-42918HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to cEPSS 0.2%CVE-2025-29864MEDIUMProtection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 beforeEPSS 0.2%