Fallos del tipo CWE-693

958 resultados

Falha em Mecanismo de Proteção

É quando um controle de segurança implementado no código falha ou é contornado, permitindo que ameaças que deveriam ser bloqueadas passem. Pode ser autenticação fraca, validação inadequada ou criptografia mal aplicada — o mecanismo existe, mas não funciona conforme deveria.

Ejemplo

Um sistema implementa autenticação por token JWT, mas não valida corretamente a assinatura ou a expiração do token. Um atacante reutiliza um token expirado ou falsificado e acessa a API como usuário autêntico, porque o mecanismo de proteção falhou em sua verificação.

Cómo mitigar

Revise e teste rigorosamente cada mecanismo de segurança (autenticação, autorização, validação de entrada, criptografia). Use bibliotecas maduras e bem auditadas, implemente testes automatizados que verifiquem falhas intencional de proteção, e considere code reviews com foco em segurança.

CVE-2026-44267CRITICALElo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitterEPSS 0.8%CVE-2025-43261CRITICALA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An aEPSS 0.8%CVE-2021-1517MEDIUMCisco Webex Meetings and Webex Meetings Server Multimedia Sharing Security Bypass VulnerabilityEPSS 0.8%CVE-2019-13924—A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versionsEPSS 0.8%CVE-2023-28284MEDIUMMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-84318HIGHNginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCEEPSS 0.8%CVE-2026-79774CRITICALWinter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicyEPSS 0.8%CVE-2022-33631HIGHMicrosoft Excel Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-57133HIGHPraisonAI utility shell safe-command wrapper allowlist bypass via shell chainingEPSS 0.8%CVE-2022-43424MEDIUMJenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can beEPSS 0.8%CVE-2022-43434MEDIUMJenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generaEPSS 0.8%CVE-2025-10157CRITICALPickleScan Bypasses Unsafe Globals Check Using Submodule ImportsEPSS 0.8%CVE-2026-72781HIGHCraft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox EscapeEPSS 0.8%CVE-2022-22759CRITICALIf a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document tEPSS 0.8%CVE-2022-22761HIGHWeb-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it wasEPSS 0.8%CVE-2025-21211MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2018-1170—This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen EPSS 0.8%CVE-2022-22152HIGHContrail Service Orchestration: Tenants able to see other tenants policies via REST API interfaceEPSS 0.8%CVE-2026-113897CRITICALThis issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27EPSS 0.8%CVE-2023-32493HIGH Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exEPSS 0.8%