Weaknesses of type CWE-693

936 results

Falha no Mecanismo de Proteção

É uma fraqueza genérica que abrange falhas em controles de segurança implementados para proteger o software—como validação, autenticação, criptografia ou controle de acesso—que não funcionam corretamente ou podem ser contornados. Quando esses mecanismos falham, o software fica exposto a ataques que deveriam ser prevenidos.

Example

Um sistema implementa CORS para restringir requisições cross-origin, mas a configuração está errada (aceita qualquer origem), permitindo que um atacante roube dados sensíveis via JavaScript malicioso executado em outro site. Ou um login exige senha forte, mas o algoritmo de hashing usado é fraco (MD5), permitindo força bruta rápida.

How to mitigate

Valide e teste rigorosamente cada mecanismo de proteção (autenticação, autorização, validação de entrada, criptografia) em cenários de ataque reais. Não confie em defaults de bibliotecas—revise configurações de segurança, use bibliotecas criptográficas consolidadas, implemente rate limiting, e mantenha logs e alertas para detectar tentativas de contorno.

CVE-2021-1517MEDIUMCisco Webex Meetings and Webex Meetings Server Multimedia Sharing Security Bypass VulnerabilityEPSS 0.8%CVE-2019-13924—A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versionsEPSS 0.8%CVE-2022-43422MEDIUMJenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executEPSS 0.8%CVE-2023-28284MEDIUMMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-84318HIGHNginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCEEPSS 0.8%CVE-2026-79774CRITICALWinter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicyEPSS 0.8%CVE-2022-33631HIGHMicrosoft Excel Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-57133HIGHPraisonAI utility shell safe-command wrapper allowlist bypass via shell chainingEPSS 0.8%CVE-2022-43424MEDIUMJenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can beEPSS 0.8%CVE-2025-10157CRITICALPickleScan Bypasses Unsafe Globals Check Using Submodule ImportsEPSS 0.8%CVE-2026-72781HIGHCraft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox EscapeEPSS 0.8%CVE-2022-22759CRITICALIf a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document tEPSS 0.8%CVE-2022-22761HIGHWeb-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it wasEPSS 0.8%CVE-2025-21211MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2022-43434MEDIUMJenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generaEPSS 0.8%CVE-2018-1170—This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen EPSS 0.8%CVE-2022-22152HIGHContrail Service Orchestration: Tenants able to see other tenants policies via REST API interfaceEPSS 0.8%CVE-2023-32493HIGH Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exEPSS 0.8%CVE-2026-120338CRITICALPrefab UI Pyodide sandbox escape to host RCEEPSS 0.8%CVE-2026-92934CRITICALvm2 before 3.11.8 Sandbox Escape RCE via AggregateErrorEPSS 0.8%