Fallos del tipo CWE-602

186 resultados

Confiança em mecanismo de segurança implementado no cliente

O servidor delega a responsabilidade de uma proteção de segurança para o cliente executar, assumindo que ele vai cumprir. Isso é perigoso porque um atacante controla o cliente e pode simplesmente ignorar, contornar ou desabilitar essa proteção, deixando o servidor vulnerável.

Ejemplo

Um servidor web que valida permissões de acesso apenas via JavaScript no navegador, sem verificar novamente no backend. Um atacante desabilita o JavaScript ou intercepta a requisição, acessando dados que não deveria.

Cómo mitigar

Implemente toda validação crítica de segurança no servidor, nunca confie em verificações feitas apenas no cliente. O cliente pode fazer validação por UX, mas o servidor deve sempre validar independentemente autenticação, autorização, entrada de dados e regras de negócio.

CVE-2022-3047MEDIUMInsufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to instalEPSS 0.6%CVE-2026-63301HIGHDenial of Service in Quick.CMSEPSS 0.6%CVE-2026-67363HIGHJoomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2EPSS 0.6%CVE-2024-12603CRITICALA logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.EPSS 0.6%CVE-2020-27268—In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDanEPSS 0.5%CVE-2026-89175MEDIUMKingdom Communication Associated｜Smart Video Intercom System - Client-Side AuthenticationEPSS 0.5%CVE-2026-84841MEDIUMtsi-coop tsi-dpdp-cms client-side enforcement of server-side securityEPSS 0.5%CVE-2026-64813CRITICALIn JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionEPSS 0.5%CVE-2025-6025HIGHOrder Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized DiscountsEPSS 0.5%CVE-2026-65051MEDIUMNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerEPSS 0.5%CVE-2026-84110MEDIUMReleasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side securityEPSS 0.5%CVE-2023-48789MEDIUMA client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access coEPSS 0.5%CVE-2026-23478CRITICALCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT CallbackEPSS 0.5%CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2026-89293HIGHMissing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingEPSS 0.5%CVE-2026-77026MEDIUMJoomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5EPSS 0.5%CVE-2023-0750CRITICALYellowbrik PEC-1864 authentication bypassEPSS 0.4%CVE-2026-13901CRITICALInsufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendererEPSS 0.4%CVE-2026-119746HIGHProSoft ICX35 Login Lockout Bypass via Client-Side CookiesEPSS 0.4%CVE-2025-42601HIGHCaptcha Bypass Vulnerability in Meon KYC solutionsEPSS 0.4%