Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,057 results · Feed
-
Medium 5.4
Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perfor…
-
Low —
Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH
### Summary The expected `protocDigest` is ignored when protoc is taken from the `PATH`. ### Details The documentation for the `protocDigest` parameter says: > ... Users may wish to specify this if using a `PATH`-based binary ... However, when specifying `<pr…
-
High 7.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, ma…
-
Medium 6.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
Medium 6.9
Missing Security Headers
Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
-
Medium 5.3
OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing
The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers (s…
-
Medium 6.5
HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)
HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
-
Medium 6.5
HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and othe…
-
Low 3.5
HCL Unica Platform is impacted by misconfigured security related HTTP headers
HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.
-
Medium 5.5
A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26. An app may bypass Gatekeep…
-
Medium 6.5CVE-2025-55886 Public exploit
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` paramet…
-
Critical 9.3
PickleScan Bypasses Unsafe Globals Check Using Submodule Imports
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing mali…
-
Critical 9.3
PickleScan Security Bypass via Bad CRC in ZIP Archive
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redun…
-
Critical 9.3
PickleScan Security Bypass Using Misleading File Extension
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file exten…
-
High 8.6
Unauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge Interface
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leadi…
-
High 7.3
Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
-
High 8.2
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An…
-
Medium 4.3
MapUrlToZone Security Feature Bypass Vulnerability
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.4
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entrie…
-
High 7.8
In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to …
-
High 7.8
In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility s…
-
Medium 6.1
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a …
-
High 7.8
In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in…
-
High 8.8
In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic er…
-
High 7.8
In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. …
-
High 7.8
In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a log…
-
High 7.8
In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error …
-
High 7.8
In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic er…
-
High 7.8
In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could …
-
High 7.8
In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic er…
-
High 7.3CVE-2025-26443 Public exploit
In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from un…
-
High 7.8
In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly …
-
High 7.8
In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This…
-
High 7.8
There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of pr…
-
High 8.8
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass …
-
High 7.8
In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due…
-
High 7.8
In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the…
-
High 7.8
In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commo…
-
Medium 5.5
In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limit…
-
Critical 9.8
In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could l…