Fallos del tipo CWE-693

833 resultados

Falha em Mecanismo de Proteção

É quando um controle de segurança implementado no código falha ou é contornado, permitindo que ameaças que deveriam ser bloqueadas passem. Pode ser autenticação fraca, validação inadequada ou criptografia mal aplicada — o mecanismo existe, mas não funciona conforme deveria.

Ejemplo

Um sistema implementa autenticação por token JWT, mas não valida corretamente a assinatura ou a expiração do token. Um atacante reutiliza um token expirado ou falsificado e acessa a API como usuário autêntico, porque o mecanismo de proteção falhou em sua verificação.

Cómo mitigar

Revise e teste rigorosamente cada mecanismo de segurança (autenticação, autorização, validação de entrada, criptografia). Use bibliotecas maduras e bem auditadas, implemente testes automatizados que verifiquem falhas intencional de proteção, e considere code reviews com foco em segurança.

CVE-2022-32910HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Security Update 2022-005EPSS 1.0%CVE-2017-2685—Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and EPSS 1.0%CVE-2026-50646HIGH.NET Framework Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-11734MEDIUMOrg.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersEPSS 1.0%CVE-2023-41319HIGHRemote Code Execution in Custom Integration Upload in FidesEPSS 0.9%CVE-2022-26384CRITICALIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they werEPSS 0.9%CVE-2024-38058MEDIUMBitLocker Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2022-3056MEDIUMInsufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass conteEPSS 0.9%CVE-2026-57281HIGHJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions mEPSS 0.9%CVE-2018-15423—Cisco HyperFlex UI Clickjacking VulnerabilityEPSS 0.9%CVE-2026-26956CRITICALvm2: WASM Sandbox Escape (Node 25 only)EPSS 0.9%CVE-2022-46698MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1EPSS 0.9%CVE-2026-41900HIGHOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution EnvironmentEPSS 0.9%CVE-2026-34348MEDIUMWindows Event Logging Service Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-24118CRITICALVM2 Sandbox Breakout Through __lookupGetter__EPSS 0.9%CVE-2025-54917MEDIUMMapUrlToZone Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2026-24120CRITICALvm2: Sandbox Breakout Through Promise SpeciesEPSS 0.9%CVE-2018-7504—A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is noEPSS 0.9%CVE-2022-3044MEDIUMInappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renEPSS 0.9%CVE-2025-46290HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS SequoEPSS 0.9%