CWE-693 · Protection Mechanism Failure (page 7)
Page 7 of 9 — CVEs classified under CWE-693, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56326 | High | 7.8 | 2024-12-23 | Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker th… |
CVE-2024-8811 | High | 7.8 | 2024-11-22 | WinZip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installa… |
CVE-2024-11197 | Medium | 4.2 | 2024-11-21 | The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application… |
CVE-2021-1494 | Medium | 5.8 | 2024-11-15 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2024-38660 | Low | 3.8 | 2024-11-13 | Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially enable escalation of… |
CVE-2024-36242 | High | 8.8 | 2024-11-13 | Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local ac… |
CVE-2024-43645 | Medium | 6.7 | 2024-11-12 | Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability |
CVE-2024-38203 | Medium | 6.2 | 2024-11-12 | Windows Package Library Manager Information Disclosure Vulnerability |
CVE-2024-51481 | | 2024-10-31 | Nix is a package manager for Linux and other Unix systems. On macOS, built-in builders (such as `builtin:fetchurl`, exposed to users with `import <nix/fetchurl… | |
CVE-2024-44122 | High | 8.8 | 2024-10-28 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An… |
CVE-2024-43585 | Medium | 5.5 | 2024-10-08 | Code Integrity Guard Security Feature Bypass Vulnerability |
CVE-2024-43584 | High | 7.7 | 2024-10-08 | Windows Scripting Engine Security Feature Bypass Vulnerability |
CVE-2024-43513 | Medium | 6.4 | 2024-10-08 | BitLocker Security Feature Bypass Vulnerability |
CVE-2024-20438 | Medium | 6.3 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected dev… |
CVE-2024-46976 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject execu… |
CVE-2024-45835 | Low | 2.5 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other miscon… |
CVE-2024-45833 | Medium | 4.5 | 2024-09-16 | Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the… |
CVE-2024-43487 | Medium | 6.5 | 2024-09-10 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-38226 | High | 7.3 | 2024-09-10 | Microsoft Publisher Security Feature Bypass Vulnerability |
CVE-2024-38217 | Medium | 5.4 | 2024-09-10 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-45411 | High | 8.5 | 2024-09-09 | Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sa… |
CVE-2022-4100 | Medium | 5.3 | 2024-08-31 | The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking fo… |
CVE-2024-20286 | Medium | 5.3 | 2024-08-28 | A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and… |
CVE-2024-20284 | Medium | 5.3 | 2024-08-28 | A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and… |
CVE-2024-39836 | Medium | 4.8 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or r… |
CVE-2024-24983 | Medium | 6.5 | 2024-08-14 | Protection mechanism failure in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 4.4 may allow an unauthenticate… |
CVE-2024-24980 | Medium | 6.1 | 2024-08-14 | Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of p… |
CVE-2024-23499 | Medium | 6.5 | 2024-08-14 | Protection mechanism failure in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 28.3 may allow… |
CVE-2024-38213 | Medium | 6.5 | 2024-08-13 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-38180 | High | 8.8 | 2024-08-13 | Windows SmartScreen Security Feature Bypass Vulnerability |
CVE-2024-0101 | High | 7.5 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enable an attacker to… |
CVE-2023-42918 | Medium | 6.3 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox r… |
CVE-2024-6741 | Medium | 5.8 | 2024-07-15 | Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using spe… |
CVE-2024-38092 | High | 8.8 | 2024-07-09 | Azure CycleCloud Elevation of Privilege Vulnerability |
CVE-2024-38070 | High | 7.8 | 2024-07-09 | Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability |
CVE-2024-38058 | Medium | 6.8 | 2024-07-09 | BitLocker Security Feature Bypass Vulnerability |
CVE-2024-39599 | Medium | 4.7 | 2024-07-09 | Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API… |
CVE-2024-27713 | High | 8.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settin… |
CVE-2024-29510 | Medium | 6.3 | 2024-07-03 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. |
CVE-2024-38874 | Medium | 5.4 | 2024-06-21 | An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lea… |
CVE-2024-6153 | High | 7.8 | 2024-06-20 | Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels softw… |
CVE-2024-37182 | Medium | 4.7 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim ove… |
CVE-2024-36287 | Low | 3.8 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS. |
CVE-2024-5924 | High | 8.8 | 2024-06-13 | Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechan… |
CVE-2024-30052 | Medium | 4.7 | 2024-06-11 | Visual Studio Remote Code Execution Vulnerability |
CVE-2024-5691 | Medium | 4.7 | 2024-06-11 | By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions… |
CVE-2024-31142 | High | 7.5 | 2024-05-16 | Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Retu… |
CVE-2024-30050 | Medium | 5.4 | 2024-05-14 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-30041 | Medium | 5.4 | 2024-05-14 | Microsoft Bing Search Spoofing Vulnerability |
CVE-2024-34144 | Critical | 9.8 | 2024-05-02 | A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with per… |
CVE-2024-33903 | Medium | 5.9 | 2024-04-29 | In CARLA through 0.9.15.2, the collision sensor mishandles some situations involving pedestrians or bicycles, in part because the collision sensor function is… |
CVE-2024-33883 | Medium | 4.0 | 2024-04-28 | The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection. |
CVE-2022-48611 | High | 7.8 | 2024-04-26 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges. |
CVE-2024-29988 | High | 8.8 | 2024-04-09 | SmartScreen Prompt Security Feature Bypass Vulnerability |
CVE-2024-28921 | Medium | 6.7 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-28920 | High | 7.8 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-28919 | Medium | 6.7 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-28903 | Medium | 6.7 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-26250 | Medium | 6.7 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-20669 | Medium | 6.7 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-20665 | Medium | 6.1 | 2024-04-09 | BitLocker Security Feature Bypass Vulnerability |
CVE-2024-30370 | Medium | 4.3 | 2024-04-02 | RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected i… |
CVE-2024-28248 | High | 7.2 | 2024-03-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.9 and prior to versions 1.13.13, 1.14.8, an… |
CVE-2024-26163 | Medium | 4.7 | 2024-03-14 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-24562 | Medium | 5.4 | 2024-03-14 | vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addresse… |
CVE-2023-42938 | High | 7.8 | 2024-03-14 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may be able to elevate their privileges. |
CVE-2023-39368 | Medium | 6.5 | 2024-03-14 | Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via n… |
CVE-2023-22655 | Medium | 6.1 | 2024-03-14 | Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to… |
CVE-2024-0681 | Medium | 5.3 | 2024-03-13 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including… |
CVE-2024-23284 | Medium | 6.5 | 2024-03-08 | A logic issue was addressed with improved state management. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS S… |
CVE-2024-25091 | Critical | 9.1 | 2024-03-01 | Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks… |
CVE-2024-0682 | Medium | 5.3 | 2024-02-28 | The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not prope… |
CVE-2024-0680 | Medium | 5.3 | 2024-02-28 | The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin n… |
CVE-2024-21423 | Medium | 4.8 | 2024-02-23 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-1671 | Medium | 6.5 | 2024-02-21 | Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafte… |
CVE-2023-52378 | Critical | 9.8 | 2024-02-18 | Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnorm… |
CVE-2024-20923 | Low | 3.1 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-0029 | High | 7.8 | 2024-02-16 | In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to l… |
CVE-2024-0014 | High | 7.8 | 2024-02-16 | In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation o… |
CVE-2022-48219 | Medium | 6.4 | 2024-02-14 | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass… |
CVE-2023-32644 | Medium | 4.3 | 2024-02-14 | Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user t… |
CVE-2023-25945 | Medium | 6.7 | 2024-02-14 | Protection mechanism failure in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-21412 | High | 8.1 | 2024-02-13 | Internet Shortcut Files Security Feature Bypass Vulnerability |
CVE-2024-20673 | High | 7.8 | 2024-02-13 | Microsoft Office Remote Code Execution Vulnerability |
CVE-2024-25744 | High | 8.8 | 2024-02-12 | In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x… |
CVE-2024-0809 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML p… |
CVE-2024-0804 | High | 7.5 | 2024-01-24 | Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2024-0747 | Medium | 6.5 | 2024-01-23 | When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy… |
CVE-2024-20926 | Medium | 5.9 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported ver… |
CVE-2023-51748 | High | 8.8 | 2024-01-11 | ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is fixed in 10.5.7 by preventing the launc… |
CVE-2023-20573 | Low | 3.2 | 2024-01-11 | A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debug information. |
CVE-2023-4466 | Low | 2.7 | 2023-12-29 | A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2014-125107 | Medium | 4.3 | 2023-12-19 | A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of the component String… |
CVE-2023-31273 | Critical | 10.0 | 2023-11-14 | Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via… |
CVE-2023-27383 | Medium | 6.8 | 2023-11-14 | Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a privileged user to p… |
CVE-2023-25080 | Medium | 5.3 | 2023-11-14 | Protection mechanism failure in some Intel(R) Distribution of OpenVINO toolkit software before version 2023.0.0 may allow an authenticated user to potentially… |
CVE-2023-5875 | Low | 3.7 | 2023-11-02 | Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious… |
CVE-2023-5557 | High | 7.5 | 2023-10-13 | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-… |
CVE-2023-45132 | Critical | 9.1 | 2023-10-11 | NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone… |
CVE-2023-45372 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merg… |