Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
375 results · Clear filters · Feed
-
High 8.8
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be…
-
High 8.3
Azure Health Bot Elevation of Privilege Vulnerability
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
-
High 7.8
Windows Mark of the Web Security Feature Bypass Vulnerability
Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally.
-
High 8.2
A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.1…
-
High 8.2
A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07…
-
High 7.0
7-Zip Mark-of-the-Web Bypass Vulnerability
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must vi…
KEV Feb 6, 2025 -
High 7.5
Windows MapUrlToZone Denial of Service Vulnerability
Windows MapUrlToZone Denial of Service Vulnerability
-
High 7.1
Microsoft Office Security Feature Bypass Vulnerability
Microsoft Office Security Feature Bypass Vulnerability
-
High 7.8
WinZip Mark-of-the-Web Bypass Vulnerability
WinZip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must …
-
High 8.8
Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially ena…
-
High 8.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS …
-
High 7.7
Windows Scripting Engine Security Feature Bypass Vulnerability
Windows Scripting Engine Security Feature Bypass Vulnerability
-
High 7.3CVE-2024-38226 Exploited
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability
KEV Sep 10, 2024 -
High 8.6
Twig has a possible sandbox bypass
Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.
-
High 8.8
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
-
High 7.5
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter…
-
High 8.6
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed pro…
-
High 8.8
Azure CycleCloud Elevation of Privilege Vulnerability
Azure CycleCloud Elevation of Privilege Vulnerability
-
High 7.8
Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability
Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability
-
High 8.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privil…
-
High 7.8
Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability
Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to exe…
-
High 8.8
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Dropbox Desktop. User interaction is required to exploit this vulne…
-
High 7.5CVE-2024-31142 EPSS 17%
x86: Incorrect logic for BTC/SRSO mitigations
Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: http…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker m…
-
High 8.8
SmartScreen Prompt Security Feature Bypass Vulnerability
SmartScreen Prompt Security Feature Bypass Vulnerability
KEV Apr 30, 2024 -
High 7.8
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
High 7.2
Cilium intermittent HTTP policy bypass
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.9 and prior to versions 1.13.13, 1.14.8, and 1.15.2, Cilium's HTTP policies are not consistently applied to all traffic in the scope of the pol…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker m…
-
High 7.1
In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic…
-
High 8.4
In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic erro…
-
High 8.1
Internet Shortcut Files Security Feature Bypass Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
KEV Feb 13, 2024 -
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Microsoft Office Remote Code Execution Vulnerability
-
High 8.8
In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is relat…
-
High 7.5
Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to…
-
High 8.8
ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is…
-
High 7.5
Tracker-miners: sandbox escape
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
-
High 7.1
A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.…
-
High 8.8
Remote Code Execution in Custom Integration Upload in Fides
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP…
-
High 7.3
Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker …
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…