CWE-602 (page 2)
Page 2 of 2 — CVEs classified under CWE-602, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47697 | High | 7.5 | 2025-05-30 | Client-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated attacker may bypass authentication and o… |
CVE-2025-33137 | High | 7.1 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another u… |
CVE-2025-20113 | High | 7.1 | 2025-05-21 | A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of… |
CVE-2025-33025 | Critical | 9.9 | 2025-05-13 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-33024 | Critical | 9.9 | 2025-05-13 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-32469 | Critical | 9.9 | 2025-05-13 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-4527 | Low | 3.7 | 2025-05-11 | A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission H… |
CVE-2025-46591 | Medium | 6.2 | 2025-05-06 | Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-28168 | Medium | 6.4 | 2025-05-05 | The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validatio… |
CVE-2025-1838 | Medium | 6.5 | 2025-05-03 | IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation i… |
CVE-2025-42601 | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exp… | |
CVE-2025-32808 | High | 7.7 | 2025-04-11 | W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side ac… |
CVE-2025-32359 | Medium | 4.8 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need… |
CVE-2024-52960 | Medium | 4.3 | 2025-03-11 | A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows a… |
CVE-2025-25497 | High | 8.1 | 2025-03-06 | An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field d… |
CVE-2025-27681 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-2022-004. |
CVE-2024-49824 | Medium | 6.5 | 2025-01-18 | IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18… |
CVE-2024-12603 | Critical | 9.8 | 2024-12-13 | A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. |
CVE-2024-9844 | High | 7.1 | 2024-12-10 | Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypa… |
CVE-2024-52008 | High | 8.8 | 2024-11-26 | Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to… |
CVE-2024-6831 | Medium | 4.4 | 2024-11-26 | Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due… |
CVE-2024-23666 | High | 7.5 | 2024-11-12 | A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 an… |
CVE-2024-20476 | Medium | 4.3 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for spe… |
CVE-2024-43188 | Medium | 4.9 | 2024-09-18 | IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client… |
CVE-2024-44106 | High | 8.8 | 2024-09-10 | Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker… |
CVE-2024-42340 | High | 8.3 | 2024-08-25 | CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security |
CVE-2024-6620 | Low | 3.5 | 2024-07-29 | Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. A(n) attacker could potentially inje… |
CVE-2024-39870 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to ma… |
CVE-2023-48789 | Medium | 4.3 | 2024-06-03 | A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted H… |
CVE-2024-32685 | Medium | 5.3 | 2024-05-17 | Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: fr… |
CVE-2024-32521 | Medium | 5.3 | 2024-05-17 | Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zer… |
CVE-2024-32512 | Medium | 5.3 | 2024-05-17 | Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a th… |
CVE-2024-31491 | High | 8.8 | 2024-05-14 | A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker… |
CVE-2024-28029 | High | 8.8 | 2024-03-21 | Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionalit… |
CVE-2024-0701 | Medium | 5.3 | 2024-02-05 | The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side re… |
CVE-2023-23570 | Medium | 5.4 | 2023-12-18 | Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. T… |
CVE-2023-42787 | Medium | 6.5 | 2023-10-10 | A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4… |
CVE-2023-3747 | Medium | 5.5 | 2023-09-07 | Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators… |
CVE-2023-39218 | Medium | 6.1 | 2023-08-08 | Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access. |
CVE-2023-30955 | Medium | 4.3 | 2023-06-29 | A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'… |
CVE-2023-20172 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying oper… |
CVE-2023-20171 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying oper… |
CVE-2023-20106 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying oper… |
CVE-2023-0750 | Critical | 9.8 | 2023-04-06 | Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker cou… |
CVE-2023-0704 | Medium | 6.5 | 2023-02-07 | Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings v… |
CVE-2023-0581 | Medium | 5.3 | 2023-01-30 | The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including… |
CVE-2022-3310 | Medium | 6.5 | 2022-11-01 | Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an appl… |
CVE-2022-3308 | High | 7.4 | 2022-11-01 | Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape vi… |
CVE-2022-3047 | Medium | 6.5 | 2022-09-26 | Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2022-1525 | Critical | 9.1 | 2022-09-06 | The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, w… |
CVE-2022-31233 | Medium | 6.3 | 2022-08-31 | Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerabi… |
CVE-2021-36338 | Medium | 6.3 | 2022-01-21 | Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulne… |
CVE-2022-20658 | Critical | 9.6 | 2022-01-14 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain… |
CVE-2021-21544 | Low | 2.7 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could… |
CVE-2021-21531 | High | 8.1 | 2021-04-30 | Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may… |
CVE-2020-27268 | Medium | 6.5 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A m… |
CVE-2020-24683 | Critical | 9.8 | 2020-12-22 | The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl… |
CVE-2020-5345 | Medium | 6.4 | 2020-06-23 | Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Relea… |
CVE-2020-8162 | High | 7.5 | 2020-06-19 | A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Conten… |
CVE-2017-12161 | High | 8.8 | 2018-02-21 | It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker cou… |
CVE-2017-14013 | Medium | 5.6 | 2017-10-17 | A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the applic… |
CVE-2014-2374 | | 2014-11-05 | The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving… | |
CVE-2014-2373 | | 2014-11-05 | The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving… |