Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,057 results · Feed
-
High 7.0
Ocp & fips mode
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
-
High 8.8
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 6.2
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally In…
-
Low 2.6
Potential HTTP policy bypass when using header rules in Cilium
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints…
-
Medium 5.4
Protection mechanism failure in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potenti…
-
Medium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 6.1
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 4.3
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
High 7.8
In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead t…
-
Medium 5.3
Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it …
-
Critical 9.9
Sandbox escape in Jenkins Email Extension Plugin
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in t…
-
Critical 9.1
The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may a…
-
High 7.5
The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data i…
-
Medium 5.5
Cortex XDR Agent: Product Disruption by Local Windows User
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.
-
High 7.8
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error …
-
Medium 6.5
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not t…
-
Medium 5.5
Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers …
-
Medium 4.3
Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross…
-
Medium 6.5
Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to …
-
High 7.5
The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect …
-
Critical 9.8
An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.
-
High 8.8
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors …
-
Critical 9.6
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to th…
-
Critical 9.6
If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…
-
Low 3.3
In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logi…
-
Medium 6.5
A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadO…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, m…
-
Medium 4.8
Medtronic MiniMed 600 Series Pump System Communication Issue
A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components. Exploitation requires nearby wireless signal proximity wit…
-
Medium 4.3
Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.
-
High 8.8
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to poten…
-
Medium 5.3
User login brute force protection functionality bypass
User login brute force protection functionality bypass
-
High 7.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Sec…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS…
-
High 8.8
Jenkins Katalon Plugin vulnerable to Protection Mechanism Failure
Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with configurable arguments, allowing attackers able to control agent processes to invoke Katalon on the …
-
Medium 4.3
Content-Security-Policy protection for user content disabled by Jenkins ScreenRecorder Plugin
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
-
Medium 5.3
Agent-to-controller security bypass vulnerability in Jenkins Compuware Xpediter Code Coverage Plugin
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the J…
-
Critical 9.9
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipe…
-
High 7.5
Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file syst…
-
Medium 5.3
Jenkins NUnit Plugin vulnerable to Protection Mechanism Failure
Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an attacker-specified …