Falhas do tipo CWE-602

185 resultados

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega uma função de segurança para o cliente executar, assumindo que o cliente vai implementar ou respeitar essa proteção. Na prática, o atacante controla o cliente e pode contornar ou desabilitar o mecanismo, comprometendo a segurança do servidor. É um erro fundamental de arquitetura: nunca confie em validações ou controles que rodem no lado do cliente.

Exemplo

Um servidor web que valida permissões apenas via JavaScript no navegador, permitindo ao usuário editar o HTML/JS localmente e contornar as restrições. Ou uma API que depende do cliente para não enviar dados além de um limite, sem validar no servidor.

Como mitigar

Implemente todas as validações críticas de segurança (autenticação, autorização, limite de taxa, validação de entrada) obrigatoriamente no servidor. Trate o cliente como potencialmente adversário e nunca confie em nada que venha dele sem re-validar no backend.

CVE-2022-3047MEDIUMInsufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to instalEPSS 0.6%CVE-2026-63301HIGHDenial of Service in Quick.CMSEPSS 0.6%CVE-2026-67363HIGHJoomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2EPSS 0.6%CVE-2024-12603CRITICALA logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.EPSS 0.6%CVE-2020-27268—In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDanEPSS 0.5%CVE-2026-89175MEDIUMKingdom Communication Associated｜Smart Video Intercom System - Client-Side AuthenticationEPSS 0.5%CVE-2026-84841MEDIUMtsi-coop tsi-dpdp-cms client-side enforcement of server-side securityEPSS 0.5%CVE-2026-64813CRITICALIn JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionEPSS 0.5%CVE-2025-6025HIGHOrder Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized DiscountsEPSS 0.5%CVE-2026-65051MEDIUMNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerEPSS 0.5%CVE-2026-84110MEDIUMReleasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side securityEPSS 0.5%CVE-2023-48789MEDIUMA client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access coEPSS 0.5%CVE-2026-23478CRITICALCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT CallbackEPSS 0.5%CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2026-89293HIGHMissing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingEPSS 0.5%CVE-2026-77026MEDIUMJoomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5EPSS 0.5%CVE-2023-0750CRITICALYellowbrik PEC-1864 authentication bypassEPSS 0.4%CVE-2026-13901CRITICALInsufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendererEPSS 0.4%CVE-2026-119746HIGHProSoft ICX35 Login Lockout Bypass via Client-Side CookiesEPSS 0.4%CVE-2025-42601HIGHCaptcha Bypass Vulnerability in Meon KYC solutionsEPSS 0.4%