Falhas do tipo CWE-693

961 resultados

Falha em Mecanismo de Proteção

CWE-693 descreve quando um mecanismo de segurança implementado no software não funciona como deveria, seja por design deficiente, implementação incorreta ou bypass não intencional. O resultado é que uma ou mais camadas de defesa falham, deixando o sistema exposto a ataques que deveriam ter sido bloqueados.

Exemplo

Um sistema implementa validação de entrada apenas no cliente (JavaScript), mas deixa a API backend sem validação equivalente. Um atacante contorna a proteção do cliente e envia dados maliciosos diretamente para o servidor, que as aceita sem filtro. O mecanismo de proteção falhou porque estava incompleto.

Como mitigar

Implementar controles de segurança em profundidade (nunca confiar apenas em uma camada), validar e sanitizar dados em todos os pontos de entrada, testar regularmente se as proteções estão funcionando conforme esperado, e documentar claramente qual é a intenção de cada controle de segurança.

CVE-2026-26956CRITICALvm2: WASM Sandbox Escape (Node 25 only)EPSS 1.1%CVE-2022-3044MEDIUMInappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renEPSS 1.1%CVE-2025-50329CRITICALAn issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code vEPSS 1.1%CVE-2023-4039MEDIUMGCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64EPSS 1.0%CVE-2024-20926MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ScriptiEPSS 1.0%CVE-2025-69264HIGHpnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"EPSS 1.0%CVE-2022-46698MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1EPSS 1.0%CVE-2026-18428HIGHSQL Query Validation Bypass in OpenSearch Direct QueryEPSS 1.0%CVE-2022-39957HIGHResponse body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept headerEPSS 1.0%CVE-2026-34348MEDIUMWindows Event Logging Service Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-45132CRITICALIgnoreIP/IgnoreCIDR should not trust X-Forwarded-ForEPSS 1.0%CVE-2026-47140CRITICALvm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code executionEPSS 1.0%CVE-2022-26384CRITICALIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they werEPSS 1.0%CVE-2017-2685—Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and EPSS 1.0%CVE-2025-54917MEDIUMMapUrlToZone Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2024-11734MEDIUMOrg.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersEPSS 0.9%CVE-2025-46290HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS SequoEPSS 0.9%CVE-2023-41319HIGHRemote Code Execution in Custom Integration Upload in FidesEPSS 0.9%CVE-2024-38058MEDIUMBitLocker Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2026-57281HIGHJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions mEPSS 0.9%