Weaknesses of type CWE-693

833 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-0065HIGHIn areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in EPSS 0.1%CVE-2026-28599HIGHIn addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This coulEPSS 0.1%CVE-2026-28650HIGHIn setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to locaEPSS 0.1%CVE-2026-28642HIGHIn executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead EPSS 0.1%CVE-2026-28660LOWIn getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local informatEPSS 0.1%CVE-2026-58726MEDIUMIn FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of pEPSS 0.1%CVE-2026-56982HIGHIn VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with SysteEPSS 0.1%CVE-2026-58765MEDIUMIn GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with SystemEPSS 0.1%CVE-2026-58747MEDIUMIn smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalaEPSS 0.1%CVE-2026-45521LOWIn openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local inEPSS 0.1%CVE-2026-58766HIGHIn multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to locEPSS 0.1%CVE-2026-28584MEDIUMIn createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the EPSS 0.1%CVE-2026-85288MEDIUMNotepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialogEPSS —