Weaknesses of type CWE-693

833 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2022-32910HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Security Update 2022-005EPSS 1.0%CVE-2017-2685—Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and EPSS 1.0%CVE-2026-50646HIGH.NET Framework Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-11734MEDIUMOrg.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersEPSS 1.0%CVE-2023-41319HIGHRemote Code Execution in Custom Integration Upload in FidesEPSS 0.9%CVE-2022-26384CRITICALIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they werEPSS 0.9%CVE-2024-38058MEDIUMBitLocker Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2022-3056MEDIUMInsufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass conteEPSS 0.9%CVE-2026-57281HIGHJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions mEPSS 0.9%CVE-2018-15423—Cisco HyperFlex UI Clickjacking VulnerabilityEPSS 0.9%CVE-2026-26956CRITICALvm2: WASM Sandbox Escape (Node 25 only)EPSS 0.9%CVE-2022-46698MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1EPSS 0.9%CVE-2026-41900HIGHOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution EnvironmentEPSS 0.9%CVE-2026-34348MEDIUMWindows Event Logging Service Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-24118CRITICALVM2 Sandbox Breakout Through __lookupGetter__EPSS 0.9%CVE-2025-54917MEDIUMMapUrlToZone Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2026-24120CRITICALvm2: Sandbox Breakout Through Promise SpeciesEPSS 0.9%CVE-2018-7504—A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is noEPSS 0.9%CVE-2022-3044MEDIUMInappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renEPSS 0.9%CVE-2025-46290HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS SequoEPSS 0.9%