Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-28849MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciouEPSS 0.2%CVE-2025-29864MEDIUMProtection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 beforeEPSS 0.2%CVE-2026-21400MEDIUMProtection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalEPSS 0.2%CVE-2026-20903MEDIUMProtection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation EPSS 0.2%CVE-2026-20906MEDIUMProtection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an EPSS 0.2%CVE-2026-0278MEDIUMPrisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on WindowsEPSS 0.2%CVE-2026-92962LOWvm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.jsEPSS 0.2%CVE-2026-20667HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4EPSS 0.2%CVE-2026-11219MEDIUMInappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictioEPSS 0.2%CVE-2026-6774MEDIUMMitigation bypass in the DOM: Security componentEPSS 0.2%CVE-2026-21387MEDIUMProtection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilegeEPSS 0.2%CVE-2026-65339MEDIUMA logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.6.1 and iPadOS 26.6.1, macOSEPSS 0.2%CVE-2026-86909MEDIUMA logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass GatekeEPSS 0.2%CVE-2026-0306MEDIUMPrisma Access Agent: EndPoint DLP Bypass Vulnerability on WindowsEPSS 0.2%CVE-2026-0011HIGHIn enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the codeEPSS 0.1%CVE-2026-56838HIGHPraisonAI recipe.run_stream skips dangerous-tool policy enforcementEPSS 0.1%CVE-2025-24835MEDIUMProtection mechanism failure in the Intel(R) Graphics Driver for the Intel(R) Arc(TM) B-Series graphics before version 32.0.101.6737 may allEPSS 0.1%CVE-2026-23553LOWx86: incomplete IBPB for vCPU isolationEPSS 0.1%CVE-2026-1232MEDIUMAnti-Tamper Bypass in BeyondTrust Privilege Management for WindowsEPSS 0.1%CVE-2025-36938MEDIUMIn U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalatioEPSS 0.1%