Falhas do tipo CWE-693

836 resultados

Falha em Mecanismo de Proteção

CWE-693 descreve quando um mecanismo de segurança implementado no software não funciona como deveria, seja por design deficiente, implementação incorreta ou bypass não intencional. O resultado é que uma ou mais camadas de defesa falham, deixando o sistema exposto a ataques que deveriam ter sido bloqueados.

Exemplo

Um sistema implementa validação de entrada apenas no cliente (JavaScript), mas deixa a API backend sem validação equivalente. Um atacante contorna a proteção do cliente e envia dados maliciosos diretamente para o servidor, que as aceita sem filtro. O mecanismo de proteção falhou porque estava incompleto.

Como mitigar

Implementar controles de segurança em profundidade (nunca confiar apenas em uma camada), validar e sanitizar dados em todos os pontos de entrada, testar regularmente se as proteções estão funcionando conforme esperado, e documentar claramente qual é a intenção de cada controle de segurança.

CVE-2017-6261HIGHNVIDIA’s Vibrante Linux version 1.1, 2.0, and 2.2 contains a vulnerability in the user space driver in which protection mechanisms are insufficient, may lead to denial of service or information disclosureEPSS 0.4%CVE-2026-43660HIGHA validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS EPSS 0.4%CVE-2026-20701HIGHAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS EPSS 0.4%CVE-2025-62453MEDIUMGitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-48806HIGHTwig: Sandbox `__toString()` policy bypass via dynamic mapping keysEPSS 0.4%CVE-2022-32802HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. ProcessinEPSS 0.4%CVE-2024-11197MEDIUMLock User Account <= 1.0.5 - User Lock BypassEPSS 0.4%CVE-2026-15618MEDIUMmosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanismEPSS 0.4%CVE-2026-57135HIGHPraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsEPSS 0.4%CVE-2024-6832MEDIUMAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksEPSS 0.4%CVE-2026-19168HIGHInappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.4%CVE-2026-65899MEDIUMDOMPurify before 3.4.9 Trusted Types Policy State ContaminationEPSS 0.4%CVE-2026-19150HIGHInappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.4%CVE-2018-10631MEDIUMMedtronic N'Vision Clinician Programmer Protection Mechanism FailureEPSS 0.4%CVE-2026-30938MEDIUMParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementEPSS 0.4%CVE-2024-0809MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions vEPSS 0.4%CVE-2026-44451CRITICALLumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypassEPSS 0.4%CVE-2026-48808MEDIUMTwig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`EPSS 0.4%CVE-2026-49458MEDIUMDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksEPSS 0.4%CVE-2026-45227HIGHHeym < 0.0.21 Sandbox Escape via Python IntrospectionEPSS 0.4%