Falhas do tipo CWE-693

961 resultados

Falha em Mecanismo de Proteção

CWE-693 descreve quando um mecanismo de segurança implementado no software não funciona como deveria, seja por design deficiente, implementação incorreta ou bypass não intencional. O resultado é que uma ou mais camadas de defesa falham, deixando o sistema exposto a ataques que deveriam ter sido bloqueados.

Exemplo

Um sistema implementa validação de entrada apenas no cliente (JavaScript), mas deixa a API backend sem validação equivalente. Um atacante contorna a proteção do cliente e envia dados maliciosos diretamente para o servidor, que as aceita sem filtro. O mecanismo de proteção falhou porque estava incompleto.

Como mitigar

Implementar controles de segurança em profundidade (nunca confiar apenas em uma camada), validar e sanitizar dados em todos os pontos de entrada, testar regularmente se as proteções estão funcionando conforme esperado, e documentar claramente qual é a intenção de cada controle de segurança.

CVE-2026-28757MEDIUMProtection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications may allow an escalationEPSS 0.1%CVE-2026-71858MEDIUMNotepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command ExecutionEPSS 0.1%CVE-2026-0097HIGHIn multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead toEPSS 0.1%CVE-2026-8009MEDIUMInappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer procEPSS 0.1%CVE-2026-0012MEDIUMIn setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This coulEPSS 0.1%CVE-2023-30757MEDIUMA vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation PEPSS 0.1%CVE-2026-7932MEDIUMInsufficient policy enforcement in Downloads in Google Chrome prior to 148.0.7778.96 allowed a local attacker to bypass navigation restrictiEPSS 0.1%CVE-2026-58978MEDIUMIn multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of priEPSS 0.1%CVE-2025-13326LOWMattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App StoreEPSS 0.1%CVE-2026-105083LOWImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPEEPSS 0.1%CVE-2025-48605HIGHIn multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead EPSS 0.1%CVE-2025-48602HIGHIn exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic erroEPSS 0.1%CVE-2026-88838MEDIUMBusybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictionsEPSS 0.1%CVE-2026-7913HIGHInsufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to perform privilegeEPSS 0.1%CVE-2025-48653HIGHIn loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could EPSS 0.1%CVE-2025-48635HIGHIn multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. ThiEPSS 0.1%CVE-2026-58946HIGHIn navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead toEPSS 0.1%CVE-2026-58934HIGHIn prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This coEPSS 0.1%CVE-2026-92074HIGHMitigation bypass in the Popup Blocker componentEPSS 0.1%CVE-2025-0089HIGHIn multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalatEPSS 0.1%