CWE-693 · Protection Mechanism Failure (page 8)
Page 8 of 9 — CVEs classified under CWE-693, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34984 | High | 7.5 | 2023-09-13 | A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to exec… |
CVE-2023-4039 | Medium | 4.8 | 2023-09-13 | **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow… |
CVE-2023-41319 | High | 8.8 | 2023-09-06 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-32493 | High | 7.3 | 2023-08-16 | Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exploit this vulnerab… |
CVE-2023-32006 | High | 8.8 | 2023-08-15 | The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. … |
CVE-2023-34427 | Medium | 5.3 | 2023-08-11 | Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to… |
CVE-2022-46329 | High | 8.2 | 2023-08-11 | Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via loca… |
CVE-2022-41984 | Medium | 4.4 | 2023-08-11 | Protection mechanism failure for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow… |
CVE-2023-38157 | Medium | 6.5 | 2023-08-07 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-35352 | High | 7.5 | 2023-07-11 | Windows Remote Desktop Security Feature Bypass Vulnerability |
CVE-2023-33150 | Critical | 9.6 | 2023-07-11 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2023-3089 | High | 7.0 | 2023-07-05 | A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic m… |
CVE-2021-31982 | High | 8.8 | 2023-07-01 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-30757 | Medium | 6.2 | 2023-06-13 | A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal)… |
CVE-2023-30851 | Low | 2.6 | 2023-05-25 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to… |
CVE-2022-41979 | Medium | 5.4 | 2023-05-10 | Protection mechanism failure in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-29354 | Medium | 4.7 | 2023-05-05 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-28286 | Medium | 6.1 | 2023-04-27 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-28284 | Medium | 4.3 | 2023-04-11 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-21024 | High | 7.8 | 2023-03-24 | In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead to local escalation of privilege with no… |
CVE-2023-0085 | Medium | 5.3 | 2023-03-02 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insuf… |
CVE-2023-25765 | Critical | 9.9 | 2023-02-15 | In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able t… |
CVE-2022-48290 | Critical | 9.1 | 2023-02-09 | The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity. |
CVE-2022-48287 | High | 7.5 | 2023-02-09 | The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data integrity. |
CVE-2023-0002 | Medium | 5.5 | 2023-02-08 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands t… |
CVE-2023-20919 | High | 7.8 | 2023-01-26 | In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local es… |
CVE-2023-23589 | Medium | 6.5 | 2023-01-14 | The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022… |
CVE-2021-26355 | Medium | 5.5 | 2023-01-11 | Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-… |
CVE-2023-0141 | Medium | 4.3 | 2023-01-10 | Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2023-0131 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a… |
CVE-2022-46762 | High | 7.5 | 2023-01-06 | The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-47544 | Critical | 9.8 | 2023-01-05 | An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed. |
CVE-2022-26384 | Critical | 9.6 | 2022-12-22 | If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a l… |
CVE-2022-22761 | High | 8.8 | 2022-12-22 | Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Ex… |
CVE-2022-22759 | Critical | 9.6 | 2022-12-22 | If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a Java… |
CVE-2022-20562 | Low | 3.3 | 2022-12-16 | In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to… |
CVE-2022-46698 | Medium | 6.5 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPad… |
CVE-2022-42848 | High | 7.8 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able… |
CVE-2022-42821 | Medium | 5.5 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatek… |
CVE-2022-32537 | Medium | 4.8 | 2022-12-12 | A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is b… |
CVE-2021-31608 | Medium | 4.3 | 2022-11-17 | Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control. |
CVE-2022-33942 | High | 8.8 | 2022-11-11 | Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege vi… |
CVE-2022-27516 | Medium | 5.3 | 2022-11-08 | User login brute force protection functionality bypass |
CVE-2022-42801 | High | 7.8 | 2022-11-01 | A logic issue was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and i… |
CVE-2022-32910 | High | 7.5 | 2022-11-01 | A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Security Update 2022-005 Catalina. An archi… |
CVE-2022-43435 | Medium | 5.3 | 2022-10-19 | Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43434 | Medium | 5.3 | 2022-10-19 | Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in work… |
CVE-2022-43433 | Medium | 4.3 | 2022-10-19 | Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43432 | Medium | 4.3 | 2022-10-19 | Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archi… |
CVE-2022-43424 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing… |
CVE-2022-43422 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attack… |
CVE-2022-21626 | Medium | 5.3 | 2022-10-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected ar… |
CVE-2022-20464 | Medium | 5.5 | 2022-10-14 | In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to… |
CVE-2022-39011 | High | 7.5 | 2022-10-14 | The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause… |
CVE-2022-39266 | Critical | 9.6 | 2022-09-29 | isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is pass… |
CVE-2022-3056 | Medium | 6.5 | 2022-09-26 | Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy… |
CVE-2022-3044 | Medium | 6.5 | 2022-09-26 | Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2022-32845 | Critical | 10.0 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to break o… |
CVE-2022-32802 | High | 7.8 | 2022-09-20 | A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously cra… |
CVE-2022-26696 | High | 8.8 | 2022-09-20 | This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sand… |
CVE-2021-33081 | High | 7.9 | 2022-09-20 | Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local a… |
CVE-2021-33079 | Medium | 4.1 | 2022-09-20 | Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local a… |
CVE-2022-39957 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset… |
CVE-2022-36085 | High | 7.4 | 2022-09-08 | Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows… |
CVE-2022-35978 | High | 7.7 | 2022-08-15 | Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lu… |
CVE-2022-33631 | High | 7.3 | 2022-08-09 | Microsoft Excel Security Feature Bypass Vulnerability |
CVE-2022-31479 | Critical | 9.6 | 2022-06-06 | An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection… |
CVE-2022-26774 | High | 7.8 | 2022-05-26 | A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their pr… |
CVE-2022-20805 | Medium | 4.1 | 2022-04-21 | A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SS… |
CVE-2021-32960 | High | 8.5 | 2022-04-01 | Rockwell Automation FactoryTalk Services Platform v6.11 and earlier, if FactoryTalk Security is enabled and deployed contains a vulnerability that may allow a… |
CVE-2021-27497 | Medium | 6.5 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks… |
CVE-2022-20738 | Medium | 5.8 | 2022-02-10 | A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature. This vu… |
CVE-2022-21283 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-22152 | High | 7.7 | 2022-01-19 | A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confide… |
CVE-2021-36310 | Medium | 4.9 | 2021-11-20 | Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A high-privileged… |
CVE-2020-12954 | Medium | 5.5 | 2021-11-16 | A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification. |
CVE-2021-35556 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE… |
CVE-2021-31386 | Medium | 5.3 | 2021-10-19 | A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-… |
CVE-2021-31362 | Medium | 6.5 | 2021-10-19 | A Protection Mechanism Failure vulnerability in RPD (routing protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthentica… |
CVE-2021-1616 | Medium | 4.7 | 2021-09-23 | A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unau… |
CVE-2021-32835 | Critical | 9.9 | 2021-09-09 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lea… |
CVE-2021-3453 | Medium | 6.8 | 2021-07-16 | Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access… |
CVE-2021-32729 | Low | 2.0 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 1… |
CVE-2021-1517 | Medium | 5.0 | 2021-06-04 | A vulnerability in the multimedia viewer feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to bypas… |
CVE-2021-27245 | High | 8.1 | 2021-03-29 | This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750… |
CVE-2021-1224 | Medium | 5.8 | 2021-01-13 | Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an u… |
CVE-2021-1223 | High | 7.5 | 2021-01-13 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2020-28396 | High | 7.3 | 2020-12-14 | A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-8022 (All versions <… |
CVE-2020-3458 | Medium | 6.7 | 2020-10-21 | Multiple vulnerabilities in the secure boot process of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software for the Fir… |
CVE-2020-3455 | High | 7.8 | 2020-10-21 | A vulnerability in the secure boot process of Cisco FXOS Software could allow an authenticated, local attacker to bypass the secure boot mechanisms. The vulner… |
CVE-2020-3299 | Medium | 5.8 | 2020-10-21 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2020-15215 | Medium | 5.6 | 2020-10-06 | Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: tr… |
CVE-2020-15174 | High | 7.5 | 2020-10-06 | In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as… |
CVE-2020-16198 | Medium | 5.0 | 2020-09-18 | When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently prove… |
CVE-2020-7320 | Medium | 6.7 | 2020-09-09 | Protection Mechanism Failure vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local administrator to te… |
CVE-2020-5379 | Medium | 6.8 | 2020-09-02 | Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to system memory may expl… |
CVE-2020-3315 | Medium | 5.3 | 2020-05-06 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the config… |
CVE-2020-3285 | Medium | 5.8 | 2020-05-06 | A vulnerability in the Transport Layer Security version 1.3 (TLS 1.3) policy with URL category functionality for Cisco Firepower Threat Defense (FTD) Software… |
CVE-2020-7277 | Medium | 6.8 | 2020-04-15 | Protection mechanism failure in all processes in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows local users to stop certai… |
CVE-2020-10598 | Medium | 6.1 | 2020-04-01 | In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk… |