Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-30904LOWProtection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of inforEPSS 0.1%CVE-2026-7937LOWInsufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a maEPSS 0.1%CVE-2025-21081LOWProtection mechanism failure for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentEPSS 0.1%CVE-2026-102704MEDIUMarbitrary read/write via grant copyEPSS 0.1%CVE-2026-86948HIGHThis issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to brEPSS 0.1%CVE-2023-20919HIGHIn getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This couEPSS 0.1%CVE-2026-65406MEDIUMA logic issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden GaEPSS 0.1%CVE-2025-43296MEDIUMA logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26. An app may bypass Gatekeeper checks.EPSS 0.1%CVE-2026-87878MEDIUMLinux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 4EPSS 0.1%CVE-2026-54073MEDIUMVeraCrypt: Hidden volume quick format weakens plausible deniabilityEPSS 0.1%CVE-2026-49859MEDIUMDeno: `fetch()` API sandbox bypass via missing DNS resolution checkEPSS 0.1%CVE-2024-0029HIGHIn multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. TEPSS 0.1%CVE-2025-26443HIGHIn parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to EPSS 0.1%CVE-2026-12457MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderEPSS 0.1%CVE-2026-85288MEDIUMNotepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialogEPSS 0.1%CVE-2024-0014HIGHIn startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead toEPSS 0.1%CVE-2026-28645MEDIUMIn onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the codeEPSS 0.1%CVE-2024-36315MEDIUMImproper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensEPSS 0.1%CVE-2026-57012HIGHIn the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of pEPSS 0.1%CVE-2025-26402MEDIUMProtection mechanism failure for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged softEPSS 0.1%