Falhas do tipo CWE-693

837 resultados

Falha em Mecanismo de Proteção

CWE-693 descreve quando um mecanismo de segurança implementado no software não funciona como deveria, seja por design deficiente, implementação incorreta ou bypass não intencional. O resultado é que uma ou mais camadas de defesa falham, deixando o sistema exposto a ataques que deveriam ter sido bloqueados.

Exemplo

Um sistema implementa validação de entrada apenas no cliente (JavaScript), mas deixa a API backend sem validação equivalente. Um atacante contorna a proteção do cliente e envia dados maliciosos diretamente para o servidor, que as aceita sem filtro. O mecanismo de proteção falhou porque estava incompleto.

Como mitigar

Implementar controles de segurança em profundidade (nunca confiar apenas em uma camada), validar e sanitizar dados em todos os pontos de entrada, testar regularmente se as proteções estão funcionando conforme esperado, e documentar claramente qual é a intenção de cada controle de segurança.

CVE-2022-26696HIGHThis issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be ableEPSS 0.3%CVE-2026-47676MEDIUMHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsEPSS 0.3%CVE-2025-8032HIGHXSLT documents could bypass CSPEPSS 0.3%CVE-2023-5875LOWLack of Hardening against media exploitation from a remote originEPSS 0.3%CVE-2022-32537MEDIUMMedtronic MiniMed 600 Series Pump System Communication IssueEPSS 0.3%CVE-2025-15618CRITICALBusiness::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret keyEPSS 0.3%CVE-2026-5903MEDIUMPolicy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific EPSS 0.3%CVE-2026-69278HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-6763MEDIUMMitigation bypass in the File Handling componentEPSS 0.3%CVE-2026-17079MEDIUMIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.3%CVE-2020-3458MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000/2100 Series Appliances Secure Boot Bypass VulnerabilitiesEPSS 0.3%CVE-2026-14097CRITICALInappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised EPSS 0.3%CVE-2026-7978HIGHInappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to perform OS-level priviEPSS 0.3%CVE-2026-14059MEDIUMInsufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origEPSS 0.3%CVE-2026-14050MEDIUMInsufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%CVE-2026-13910MEDIUMInsufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dEPSS 0.3%CVE-2026-84810HIGHclaude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory ScanEPSS 0.3%CVE-2026-41469MEDIUMBeghelli Sicuro24 SicuroWeb Missing Content Security PolicyEPSS 0.3%CVE-2025-12094MEDIUMOOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header SpoofingEPSS 0.3%CVE-2026-92039MEDIUMMitigation bypass in the DOM: Notifications componentEPSS 0.3%