Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,057 results · Feed
-
High 8.6
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed pro…
-
Medium 5.8
Openfind Mail2000 - HttpOnly flag bypass
Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.
-
High 8.8
Azure CycleCloud Elevation of Privilege Vulnerability
Azure CycleCloud Elevation of Privilege Vulnerability
-
High 7.8
Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability
Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability
-
Medium 6.8
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
Medium 4.7
[CVE-2024-39599] Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform
Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's confidentiality, in…
-
High 8.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privil…
-
Medium 6.3
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with…
-
Medium 5.4
events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability
An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or dele…
-
High 7.8
Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability
Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to exe…
-
Medium 4.7
Lack of permissions prompting when opening external URLs
Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.
-
Low 3.8
Bypass of TCC restrictions on macOS
Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
-
High 8.8
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Dropbox Desktop. User interaction is required to exploit this vulne…
-
Medium 4.7CVE-2024-30052 Public exploit
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
Medium 4.7
By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clic…
-
High 7.5CVE-2024-31142 EPSS 17%
x86: Incorrect logic for BTC/SRSO mitigations
Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: http…
-
Medium 5.4
Microsoft Bing Search Spoofing Vulnerability
Microsoft Bing Search Spoofing Vulnerability
-
Medium 5.4CVE-2024-30050 EPSS 11%
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
-
Critical 9.8
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection a…
-
Medium 5.9
In CARLA through 0.9.15.2, the collision sensor mishandles some situations involving pedestrians or bicycles, in part b…
-
Medium 4.0CVE-2024-33883 Public exploit
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker m…
-
Medium 6.1
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
High 8.8
SmartScreen Prompt Security Feature Bypass Vulnerability
SmartScreen Prompt Security Feature Bypass Vulnerability
KEV Apr 30, 2024 -
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
High 7.8
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 4.3
RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability
RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that th…
-
High 7.2
Cilium intermittent HTTP policy bypass
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.9 and prior to versions 1.13.13, 1.14.8, and 1.15.2, Cilium's HTTP policies are not consistently applied to all traffic in the scope of the pol…
-
Medium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 5.4
Security headers not set in vantage6-UI
vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to up…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker m…
-
Medium 6.5
Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to po…
-
Medium 6.1
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Inte…
-
Medium 5.3
Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.3.4. This is due to the plugin not properly restricting access to pages via the REST API when a pa…
-
Medium 6.5
A logic issue was addressed with improved state management. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 1…
-
Critical 9.1
Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or…