Fallos del tipo CWE-693

836 resultados

Falha em Mecanismo de Proteção

É quando um controle de segurança implementado no código falha ou é contornado, permitindo que ameaças que deveriam ser bloqueadas passem. Pode ser autenticação fraca, validação inadequada ou criptografia mal aplicada — o mecanismo existe, mas não funciona conforme deveria.

Ejemplo

Um sistema implementa autenticação por token JWT, mas não valida corretamente a assinatura ou a expiração do token. Um atacante reutiliza um token expirado ou falsificado e acessa a API como usuário autêntico, porque o mecanismo de proteção falhou em sua verificação.

Cómo mitigar

Revise e teste rigorosamente cada mecanismo de segurança (autenticação, autorização, validação de entrada, criptografia). Use bibliotecas maduras e bem auditadas, implemente testes automatizados que verifiquem falhas intencional de proteção, e considere code reviews com foco em segurança.

CVE-2026-74896CRITICALopenssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute TraversalEPSS 0.3%CVE-2026-19152HIGHInsufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renEPSS 0.3%CVE-2025-11260MEDIUMWP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism BypassEPSS 0.3%CVE-2026-80198HIGHKimai before 2.56.0 Information Disclosure via config() Twig FunctionEPSS 0.3%CVE-2026-44071LOWFORTIFY_SOURCE disabledEPSS 0.3%CVE-2020-10598—In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability eEPSS 0.3%CVE-2026-14101CRITICALInsufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the EPSS 0.3%CVE-2026-14151HIGHInappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2022-26696HIGHThis issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be ableEPSS 0.3%CVE-2025-8032HIGHXSLT documents could bypass CSPEPSS 0.3%CVE-2026-78552MEDIUMValidation Bypass in Okta Access Gateway Custom DirectivesEPSS 0.3%CVE-2026-79683HIGHDell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploEPSS 0.3%CVE-2025-15618CRITICALBusiness::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret keyEPSS 0.3%CVE-2023-5875LOWLack of Hardening against media exploitation from a remote originEPSS 0.3%CVE-2022-32537MEDIUMMedtronic MiniMed 600 Series Pump System Communication IssueEPSS 0.3%CVE-2026-74983HIGHMitigation bypass in the Data Loss Prevention componentEPSS 0.3%CVE-2026-82855CRITICAL@hulumi/policies before 1.3.2 Evidence Validation BypassEPSS 0.3%CVE-2026-20702HIGHProtection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. UnprivilEPSS 0.3%CVE-2026-87808HIGHSiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlockEPSS 0.3%CVE-2026-70608HIGHElectron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathEPSS 0.3%