Falhas do tipo CWE-602

174 resultados

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega uma função de segurança para o cliente executar, assumindo que o cliente vai implementar ou respeitar essa proteção. Na prática, o atacante controla o cliente e pode contornar ou desabilitar o mecanismo, comprometendo a segurança do servidor. É um erro fundamental de arquitetura: nunca confie em validações ou controles que rodem no lado do cliente.

Exemplo

Um servidor web que valida permissões apenas via JavaScript no navegador, permitindo ao usuário editar o HTML/JS localmente e contornar as restrições. Ou uma API que depende do cliente para não enviar dados além de um limite, sem validar no servidor.

Como mitigar

Implemente todas as validações críticas de segurança (autenticação, autorização, limite de taxa, validação de entrada) obrigatoriamente no servidor. Trate o cliente como potencialmente adversário e nunca confie em nada que venha dele sem re-validar no backend.

CVE-2026-17974MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictioEPSS 0.2%CVE-2026-3941MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictiEPSS 0.2%CVE-2026-56693MEDIUMNanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System ActionEPSS 0.2%CVE-2026-65938MEDIUMWhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.EPSS 0.2%CVE-2026-11184MEDIUMInsufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictionsEPSS 0.2%CVE-2024-6831MEDIUMSeth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necesEPSS 0.2%CVE-2025-6249HIGHAn authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions EPSS 0.2%CVE-2026-5901MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a maEPSS 0.1%CVE-2026-11267MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2026-11062MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2025-41402MEDIUMClient-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competeEPSS 0.1%CVE-2024-41751MEDIUMIBM SmartCloud Analytics - Log Analysis security bypassEPSS 0.1%CVE-2024-41750MEDIUMIBM SmartCloud Analytics - Log Analysis security bypassEPSS 0.1%CVE-2025-46591MEDIUMOut-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%