CWE-693 · Protection Mechanism Failure (page 5)
Page 5 of 8 — CVEs classified under CWE-693, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22427 | High | 7.3 | 2025-09-02 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in… |
CVE-2024-49720 | High | 7.8 | 2025-09-02 | In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. T… |
CVE-2025-20347 | Medium | 5.4 | 2025-08-27 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privile… |
CVE-2025-43728 | Critical | 9.6 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could pote… |
CVE-2025-54143 | Critical | 9.8 | 2025-08-19 | Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vu… |
CVE-2025-50897 | Medium | 4.3 | 2025-08-19 | A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with wr… |
CVE-2025-24835 | Medium | 6.5 | 2025-08-12 | Protection mechanism failure in the Intel(R) Graphics Driver for the Intel(R) Arc(TM) B-Series graphics before version 32.0.101.6737 may allow an authenticated… |
CVE-2025-24523 | Low | 3.5 | 2025-08-12 | Protection mechanism failure for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to… |
CVE-2025-3770 | High | 7.0 | 2025-08-07 | EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability… |
CVE-2025-8656 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on… |
CVE-2025-43273 | Critical | 9.1 | 2025-07-30 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.8. A sandboxed process may b… |
CVE-2025-43261 | Critical | 9.8 | 2025-07-30 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to b… |
CVE-2025-8032 | High | 8.1 | 2025-07-22 | XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13… |
CVE-2025-52951 | Medium | 5.8 | 2025-07-11 | A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the d… |
CVE-2025-46358 | High | 7.7 | 2025-07-11 | Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the produc… |
CVE-2025-49740 | High | 8.8 | 2025-07-08 | Protection mechanism failure in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-48800 | Medium | 6.8 | 2025-07-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-48003 | Medium | 6.8 | 2025-07-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-47984 | High | 7.5 | 2025-07-08 | Protection mechanism failure in Windows GDI allows an unauthorized attacker to disclose information over a network. |
CVE-2025-47159 | High | 7.8 | 2025-07-08 | Protection mechanism failure in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2025-41224 | High | 8.8 | 2025-07-08 | A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.10.0), RUGGEDCOM RS416NCv2… |
CVE-2025-6427 | Critical | 9.1 | 2025-06-24 | An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connectio… |
CVE-2025-49193 | Medium | 4.2 | 2025-06-12 | The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing… |
CVE-2025-47160 | Medium | 5.4 | 2025-06-10 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-33050 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-32725 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-31189 | High | 8.2 | 2025-05-29 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may… |
CVE-2025-27700 | High | 8.4 | 2025-05-27 | There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to local escalation of privilege with no additional execution… |
CVE-2025-41232 | Critical | 9.1 | 2025-05-21 | Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may… |
CVE-2025-21081 | Medium | 4.5 | 2025-05-13 | Protection mechanism failure for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escala… |
CVE-2025-31244 | High | 8.8 | 2025-05-12 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31224 | High | 7.8 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to b… |
CVE-2025-46553 | Medium | 6.1 | 2025-05-05 | @misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` f… |
CVE-2025-3114 | | 2025-04-09 | Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, pote… | |
CVE-2025-27472 | Medium | 5.4 | 2025-04-08 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-26637 | Medium | 6.8 | 2025-04-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-21384 | High | 8.3 | 2025-04-01 | An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network. |
CVE-2025-24061 | High | 7.8 | 2025-03-11 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2024-56182 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V… |
CVE-2024-56181 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V2… |
CVE-2025-27665 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection and thus drivers can… |
CVE-2025-1222 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2024-13794 | Medium | 5.3 | 2025-02-12 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02… |
CVE-2025-0411 | High | 7.0 | 2025-01-25 | 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installat… |
CVE-2025-0575 | Low | 3.9 | 2025-01-19 | A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the comp… |
CVE-2025-21346 | High | 7.1 | 2025-01-14 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2025-21276 | High | 7.5 | 2025-01-14 | Windows MapUrlToZone Denial of Service Vulnerability |
CVE-2025-21217 | Medium | 6.5 | 2025-01-14 | Windows NTLM Spoofing Vulnerability |
CVE-2025-21211 | Medium | 6.8 | 2025-01-14 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-11734 | Medium | 6.5 | 2025-01-14 | A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service… |
CVE-2024-56326 | High | 7.8 | 2024-12-23 | Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker th… |
CVE-2024-8811 | High | 7.8 | 2024-11-22 | WinZip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installa… |
CVE-2024-11197 | Medium | 4.2 | 2024-11-21 | The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application… |
CVE-2021-1494 | Medium | 5.8 | 2024-11-15 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2024-38660 | Low | 3.8 | 2024-11-13 | Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially enable escalation of… |
CVE-2024-36242 | High | 8.8 | 2024-11-13 | Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local ac… |
CVE-2024-43645 | Medium | 6.7 | 2024-11-12 | Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability |
CVE-2024-38203 | Medium | 6.2 | 2024-11-12 | Windows Package Library Manager Information Disclosure Vulnerability |
CVE-2024-51481 | | 2024-10-31 | Nix is a package manager for Linux and other Unix systems. On macOS, built-in builders (such as `builtin:fetchurl`, exposed to users with `import <nix/fetchurl… | |
CVE-2024-44122 | High | 8.8 | 2024-10-28 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An… |
CVE-2024-43585 | Medium | 5.5 | 2024-10-08 | Code Integrity Guard Security Feature Bypass Vulnerability |
CVE-2024-43584 | High | 7.7 | 2024-10-08 | Windows Scripting Engine Security Feature Bypass Vulnerability |
CVE-2024-43513 | Medium | 6.4 | 2024-10-08 | BitLocker Security Feature Bypass Vulnerability |
CVE-2024-20438 | Medium | 6.3 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected dev… |
CVE-2024-46976 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject execu… |
CVE-2024-45835 | Low | 2.5 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other miscon… |
CVE-2024-45833 | Medium | 4.5 | 2024-09-16 | Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the… |
CVE-2024-43487 | Medium | 6.5 | 2024-09-10 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-38226 | High | 7.3 | 2024-09-10 | Microsoft Publisher Security Feature Bypass Vulnerability |
CVE-2024-38217 | Medium | 5.4 | 2024-09-10 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-45411 | High | 8.5 | 2024-09-09 | Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sa… |
CVE-2022-4100 | Medium | 5.3 | 2024-08-31 | The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking fo… |
CVE-2024-20286 | Medium | 5.3 | 2024-08-28 | A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and… |
CVE-2024-20284 | Medium | 5.3 | 2024-08-28 | A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and… |
CVE-2024-39836 | Medium | 4.8 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or r… |
CVE-2024-24983 | Medium | 6.5 | 2024-08-14 | Protection mechanism failure in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 4.4 may allow an unauthenticate… |
CVE-2024-24980 | Medium | 6.1 | 2024-08-14 | Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of p… |
CVE-2024-23499 | Medium | 6.5 | 2024-08-14 | Protection mechanism failure in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 28.3 may allow… |
CVE-2024-38213 | Medium | 6.5 | 2024-08-13 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-38180 | High | 8.8 | 2024-08-13 | Windows SmartScreen Security Feature Bypass Vulnerability |
CVE-2024-0101 | High | 7.5 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enable an attacker to… |
CVE-2023-42918 | Medium | 6.3 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox r… |
CVE-2024-6741 | Medium | 5.8 | 2024-07-15 | Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using spe… |
CVE-2024-38092 | High | 8.8 | 2024-07-09 | Azure CycleCloud Elevation of Privilege Vulnerability |
CVE-2024-38070 | High | 7.8 | 2024-07-09 | Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability |
CVE-2024-38058 | Medium | 6.8 | 2024-07-09 | BitLocker Security Feature Bypass Vulnerability |
CVE-2024-39599 | Medium | 4.7 | 2024-07-09 | Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API… |
CVE-2024-27713 | High | 8.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settin… |
CVE-2024-29510 | Medium | 6.3 | 2024-07-03 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. |
CVE-2024-38874 | Medium | 5.4 | 2024-06-21 | An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lea… |
CVE-2024-6153 | High | 7.8 | 2024-06-20 | Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels softw… |
CVE-2024-37182 | Medium | 4.7 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim ove… |
CVE-2024-36287 | Low | 3.8 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS. |
CVE-2024-5924 | High | 8.8 | 2024-06-13 | Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechan… |
CVE-2024-30052 | Medium | 4.7 | 2024-06-11 | Visual Studio Remote Code Execution Vulnerability |
CVE-2024-5691 | Medium | 4.7 | 2024-06-11 | By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions… |
CVE-2024-31142 | High | 7.5 | 2024-05-16 | Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Retu… |
CVE-2024-30050 | Medium | 5.4 | 2024-05-14 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-30041 | Medium | 5.4 | 2024-05-14 | Microsoft Bing Search Spoofing Vulnerability |
CVE-2024-34144 | Critical | 9.8 | 2024-05-02 | A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with per… |