CWE-693: Protection Mechanism Failure, page 15
Filter
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
What the weakness is: CWE-693 at MITRE
Ask an AI about CWE-693
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-693: Protection Mechanism Failure and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/693.html and https://cve.bz/cve/cwe/693?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.3CVE-2023-42918EPSS 0.2%
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox restrictions.
- 5.3CVE-2024-6741EPSS 0.6%
Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enable…
- 8.8CVE-2024-38092EPSS 1.6%
Azure CycleCloud Elevation of Privilege Vulnerability
- 7.8CVE-2024-38070EPSS 0.7%
Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability
- 6.8CVE-2024-38058EPSS 0.9%
BitLocker Security Feature Bypass Vulnerability
- 4.7CVE-2024-39599EPSS 0.3%
Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's…
- 8.8CVE-2024-27713EPSS 0.6%
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settings component.
- 6.3CVE-2024-29510ExploitEPSS 28%
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
- 5.4CVE-2024-38874EPSS 0.3%
An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential…
- 7.8CVE-2024-6153EPSS 0.3%
Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtai…
- 6.1CVE-2024-37182EPSS 0.3%
Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI s…
- 3.3CVE-2024-36287EPSS 0.2%
Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
- 8.8CVE-2024-5924EPSS 1.2%
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Dropbox Desktop. User interaction is required t…
- 4.7CVE-2024-30052EPSS 1.4%
Visual Studio Remote Code Execution Vulnerability
- 4.7CVE-2024-5691EPSS 0.7%
By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 1…
- 7.5CVE-2024-31142EPSS 17%
Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For mo…
- 5.4CVE-2024-30050EPSS 11%
Windows Mark of the Web Security Feature Bypass Vulnerability
- 5.4CVE-2024-30041EPSS 0.7%
Microsoft Bing Search Spoofing Vulnerability
- 9.8CVE-2024-34144EPSS 48%
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the …
- 5.9CVE-2024-33903EPSS 0.5%
In CARLA through 0.9.15.2, the collision sensor mishandles some situations involving pedestrians or bicycles, in part because the collision sensor function is not exposed to the Blueprint library.
- 4.0CVE-2024-33883EPSS 0.6%
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
- 7.8CVE-2022-48611EPSS 0.2%
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.
- 8.8CVE-2024-29988KEVEPSS 45%
SmartScreen Prompt Security Feature Bypass Vulnerability
- 6.7CVE-2024-28921EPSS 0.7%
Secure Boot Security Feature Bypass Vulnerability
- 7.8CVE-2024-28920EPSS 0.7%
Secure Boot Security Feature Bypass Vulnerability
- 6.7CVE-2024-28919EPSS 0.6%
Secure Boot Security Feature Bypass Vulnerability
- 6.7CVE-2024-28903EPSS 0.7%
Secure Boot Security Feature Bypass Vulnerability
- 6.7CVE-2024-26250EPSS 0.6%
Secure Boot Security Feature Bypass Vulnerability
- 6.7CVE-2024-20669EPSS 0.6%
Secure Boot Security Feature Bypass Vulnerability
- 6.7CVE-2024-20665EPSS 0.7%
BitLocker Security Feature Bypass Vulnerability
- 4.3CVE-2024-30370EPSS 1.2%
RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vuln…
- 7.2CVE-2024-28248EPSS 0.6%
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.9 and prior to versions 1.13.13, 1.14.8, and 1.15.2, Cilium's HTTP policies are not consistently applied to all traffic in …
- 4.7CVE-2024-26163EPSS 2.1%
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- 5.3CVE-2024-24562EPSS 0.3%
vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Use…
- 7.8CVE-2023-42938EPSS 0.2%
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may be able to elevate their privileges.
- 6.5CVE-2023-39368EPSS 0.8%
Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via network access.
- 6.1CVE-2023-22655EPSS 0.2%
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
- 5.3CVE-2024-0681EPSS 0.6%
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.3.4. This is due to the plugin not properly restricting access to pages via th…
- 6.5CVE-2024-23284EPSS 1.5%
A logic issue was addressed with improved state management. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing maliciously crafte…
- 9.1CVE-2024-25091EPSS 0.5%
Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks Browser prior to 2.2.95 (when using 'VirusChecker' or 'ThreatChecker' feature). …
- 5.3CVE-2024-0682EPSS 0.5%
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made priva…
- 5.3CVE-2024-0680EPSS 0.6%
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been ma…
- 4.8CVE-2024-21423EPSS 0.6%
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- 6.5CVE-2024-1671EPSS 0.8%
Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
- 9.8CVE-2023-52378EPSS 0.5%
Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 3.1CVE-2024-20923EPSS 0.6%
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. …
- 7.8CVE-2024-0029EPSS 0.1%
In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. Use…
- 7.8CVE-2024-0014EPSS 0.1%
In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
- 6.4CVE-2022-48219EPSS 0.3%
Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these p…
- 6.5CVE-2023-32644EPSS 0.4%
Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.