Falhas do tipo CWE-602

174 resultados

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega uma função de segurança para o cliente executar, assumindo que o cliente vai implementar ou respeitar essa proteção. Na prática, o atacante controla o cliente e pode contornar ou desabilitar o mecanismo, comprometendo a segurança do servidor. É um erro fundamental de arquitetura: nunca confie em validações ou controles que rodem no lado do cliente.

Exemplo

Um servidor web que valida permissões apenas via JavaScript no navegador, permitindo ao usuário editar o HTML/JS localmente e contornar as restrições. Ou uma API que depende do cliente para não enviar dados além de um limite, sem validar no servidor.

Como mitigar

Implemente todas as validações críticas de segurança (autenticação, autorização, limite de taxa, validação de entrada) obrigatoriamente no servidor. Trate o cliente como potencialmente adversário e nunca confie em nada que venha dele sem re-validar no backend.

CVE-2026-64813CRITICALIn JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionEPSS 0.5%CVE-2026-65051MEDIUMNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerEPSS 0.5%CVE-2026-72867CRITICALDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)EPSS 0.5%CVE-2023-48789MEDIUMA client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access coEPSS 0.5%CVE-2022-3047MEDIUMInsufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to instalEPSS 0.5%CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.5%CVE-2026-23478CRITICALCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT CallbackEPSS 0.5%CVE-2025-6025HIGHOrder Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized DiscountsEPSS 0.5%CVE-2023-0750CRITICALYellowbrik PEC-1864 authentication bypassEPSS 0.4%CVE-2025-42601HIGHCaptcha Bypass Vulnerability in Meon KYC solutionsEPSS 0.4%CVE-2026-46485HIGHDash: Users can write to config despire permissions (OIDC tested)EPSS 0.4%CVE-2025-43699MEDIUMClient-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission checEPSS 0.4%CVE-2026-57913HIGHJohnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.EPSS 0.4%CVE-2026-57912HIGHJohnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about studentEPSS 0.4%CVE-2026-56256HIGHCapgo - Two-Factor Authentication Bypass via Organization Management APIEPSS 0.4%CVE-2026-17703MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigatEPSS 0.4%CVE-2026-14086HIGHInsufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a craEPSS 0.4%CVE-2025-20113HIGHCisco Unified Intelligence Center Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-20172MEDIUMCisco Identity Services Engine Arbitrary File Delete and File Read VulnerabilitiesEPSS 0.4%