Weaknesses of type CWE-693

961 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2026-28612HIGHIn resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. EPSS 0.1%CVE-2023-21024HIGHIn maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead to local escalation ofEPSS 0.1%CVE-2025-48531HIGHIn getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to loEPSS 0.1%CVE-2025-32331HIGHIn showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This couEPSS 0.1%CVE-2025-26464HIGHIn executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. ThisEPSS 0.1%CVE-2025-52643MEDIUMHCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environmentEPSS 0.1%CVE-2025-22433HIGHIn canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work ProfEPSS 0.1%CVE-2026-58726MEDIUMIn FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of pEPSS 0.1%CVE-2025-48522HIGHIn setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code.EPSS 0.1%CVE-2026-57006MEDIUMIn acfw_ffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information disclosure with SystemEPSS 0.1%CVE-2026-56982HIGHIn VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with SysteEPSS 0.1%CVE-2026-87100LOWProtection mechanism failure due to missing binary hardening in Linux executables. The following products are affected: Acronis Cyber ProtecEPSS 0.1%CVE-2024-49720HIGHIn multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic eEPSS 0.1%CVE-2026-0118HIGHIn oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could lead to local escalation of privilege withEPSS 0.1%CVE-2025-48546HIGHIn checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This couldEPSS 0.1%CVE-2025-22427HIGHIn onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due tEPSS 0.1%CVE-2025-26444HIGHIn onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the defaultEPSS 0.1%CVE-2026-28660LOWIn getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local informatEPSS 0.1%CVE-2025-26458HIGHIn multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. ThisEPSS 0.1%CVE-2025-22434HIGHIn handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could leaEPSS 0.1%