Fallos del tipo CWE-693

836 resultados

Falha em Mecanismo de Proteção

É quando um controle de segurança implementado no código falha ou é contornado, permitindo que ameaças que deveriam ser bloqueadas passem. Pode ser autenticação fraca, validação inadequada ou criptografia mal aplicada — o mecanismo existe, mas não funciona conforme deveria.

Ejemplo

Um sistema implementa autenticação por token JWT, mas não valida corretamente a assinatura ou a expiração do token. Um atacante reutiliza um token expirado ou falsificado e acessa a API como usuário autêntico, porque o mecanismo de proteção falhou em sua verificação.

Cómo mitigar

Revise e teste rigorosamente cada mecanismo de segurança (autenticação, autorização, validação de entrada, criptografia). Use bibliotecas maduras e bem auditadas, implemente testes automatizados que verifiquem falhas intencional de proteção, e considere code reviews com foco em segurança.

CVE-2026-21668HIGHA vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.EPSS 0.5%CVE-2017-3893LOWIncomplete vulnerability mitigationsEPSS 0.5%CVE-2021-32729LOWA user without PR can reset user authentication failures informationEPSS 0.5%CVE-2024-0682MEDIUMPage Restrict <= 2.5.5 - Protection Mechanism BypassEPSS 0.5%CVE-2024-0804HIGHInsufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin daEPSS 0.5%CVE-2026-17669CRITICALInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perfoEPSS 0.5%CVE-2024-43585MEDIUMCode Integrity Guard Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-48546HIGHKanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjsEPSS 0.5%CVE-2026-39420MEDIUMMaxKB: Sandbox escape via LD_PRELOAD bypassEPSS 0.5%CVE-2026-59854MEDIUMSiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspaceEPSS 0.5%CVE-2026-48805MEDIUMTwig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`EPSS 0.5%CVE-2025-54143CRITICALSandboxed iframes could allow local downloads despite sandbox restrictionsEPSS 0.5%CVE-2026-50661MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2024-25091CRITICALProtection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' featEPSS 0.5%CVE-2026-0877HIGHMitigation bypass in the DOM: Security componentEPSS 0.5%CVE-2026-17677HIGHInappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a EPSS 0.5%CVE-2026-17710CRITICALInappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeEPSS 0.5%CVE-2026-17676CRITICALInappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rEPSS 0.5%CVE-2026-17695CRITICALInappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandEPSS 0.5%CVE-2025-66204MEDIUMWBCE CMS allows brute-force protection bypass using X-Forwarded-For headerEPSS 0.5%