Fallos del tipo CWE-693

836 resultados

Falha em Mecanismo de Proteção

É quando um controle de segurança implementado no código falha ou é contornado, permitindo que ameaças que deveriam ser bloqueadas passem. Pode ser autenticação fraca, validação inadequada ou criptografia mal aplicada — o mecanismo existe, mas não funciona conforme deveria.

Ejemplo

Um sistema implementa autenticação por token JWT, mas não valida corretamente a assinatura ou a expiração do token. Um atacante reutiliza um token expirado ou falsificado e acessa a API como usuário autêntico, porque o mecanismo de proteção falhou em sua verificação.

Cómo mitigar

Revise e teste rigorosamente cada mecanismo de segurança (autenticação, autorização, validação de entrada, criptografia). Use bibliotecas maduras e bem auditadas, implemente testes automatizados que verifiquem falhas intencional de proteção, e considere code reviews com foco em segurança.

CVE-2025-46290HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS SequoEPSS 0.9%CVE-2026-20824MEDIUMWindows Remote Assistance Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2023-5557HIGHTracker-miners: sandbox escapeEPSS 0.9%CVE-2024-45411HIGHTwig has a possible sandbox bypassEPSS 0.8%CVE-2021-27497MEDIUMPhilips Vue PACS Protection Mechanism FailureEPSS 0.8%CVE-2025-26637MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2021-36310MEDIUMDell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API serviceEPSS 0.8%CVE-2026-33396CRITICALOneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on ProbeEPSS 0.8%CVE-2023-23589MEDIUMThe SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protoEPSS 0.8%CVE-2025-47160MEDIUMWindows Shortcut Files Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2021-1517MEDIUMCisco Webex Meetings and Webex Meetings Server Multimedia Sharing Security Bypass VulnerabilityEPSS 0.8%CVE-2019-13924—A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versionsEPSS 0.8%CVE-2023-28284MEDIUMMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-47140CRITICALvm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code executionEPSS 0.8%CVE-2022-33631HIGHMicrosoft Excel Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2025-43261CRITICALA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An aEPSS 0.8%CVE-2023-45132CRITICALIgnoreIP/IgnoreCIDR should not trust X-Forwarded-ForEPSS 0.8%CVE-2025-10157CRITICALPickleScan Bypasses Unsafe Globals Check Using Submodule ImportsEPSS 0.8%CVE-2018-1170—This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen EPSS 0.8%CVE-2025-49740HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 0.8%