Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
375 results · Clear filters · Feed
-
High 8.2
Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially…
-
High 7.5
Windows Remote Desktop Security Feature Bypass Vulnerability
Windows Remote Desktop Security Feature Bypass Vulnerability
-
High 7.0
Ocp & fips mode
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
-
High 8.8
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
High 7.8
In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead t…
-
High 7.5
The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data i…
-
High 7.8
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error …
-
High 7.5
The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect …
-
High 8.8
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors …
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadO…
-
High 8.8
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to poten…
-
High 7.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Sec…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS…
-
High 8.8
Jenkins Katalon Plugin vulnerable to Protection Mechanism Failure
Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with configurable arguments, allowing attackers able to control agent processes to invoke Katalon on the …
-
High 7.5
Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file syst…
-
High 8.8
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin
A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts…
-
High 8.8
Sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin
A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypa…
-
High 8.8
Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sand…
-
High 8.8
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pip…
-
High 7.5
The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful explo…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Mon…
-
High 8.8
This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxe…
-
High 7.9
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially e…
-
High 7.3
Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this re…
-
High 7.4
OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions
Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — …
-
High 7.7CVE-2022-35978 Public exploit
Lua sandbox escape from mod in Minetest
Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is e…
-
High 7.3
Microsoft Excel Security Feature Bypass Vulnerability
Microsoft Excel Security Feature Bypass Vulnerability
-
High 7.5
Unauthorized view fragment access in Jenkins
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
-
High 7.8
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local …
-
High 8.5
Rockwell Automation FactoryTalk Services Platform Protection Mechanism Failure
Rockwell Automation FactoryTalk Services Platform v6.11 and earlier, if FactoryTalk Security is enabled and deployed contains a vulnerability that may allow a remote, authenticated attacker to bypass FactoryTalk Security policies based on the computer name. I…
-
High 8.8
Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the contex…
-
High 8.8
Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a…
-
High 8.8
Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM content…
-
High 7.7
Contrail Service Orchestration: Tenants able to see other tenants policies via REST API interface
A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one ten…
-
High 7.5
Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS comman…
-
High 8.1
Agent-to-controller security bypass in Jenkins Squash TM Publisher (Squash4Jenkins) Plugin allows writing arbitrary files
Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins c…
-
High 8.8
Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library w…
-
High 8.8
Jenkins Azure AD Plugin allows bypassing CSRF protection for any URL
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
-
High 8.8
Jenkins SAML Plugin allows bypassing CSRF protection for any URL
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
-
High 8.8
Remote code execution vulnerability in Jenkins Templating Engine Plugin
Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.