CWE-693: Protection Mechanism Failure, page 16

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

What the weakness is: CWE-693 at MITRE

1. 7.8CVE-2023-25945EPSS 0.2%2024-02-14

   Protection mechanism failure in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access.

2. 8.1CVE-2024-21412KEVEPSS 99.4%2024-02-13

   Internet Shortcut Files Security Feature Bypass Vulnerability

3. 7.8CVE-2024-20673EPSS 1.2%2024-02-13

   Microsoft Office Remote Code Execution Vulnerability

4. 8.8CVE-2024-25744EPSS 0.3%2024-02-12

   In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.

5. 4.3CVE-2024-0809EPSS 0.4%2024-01-24

   Inappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)

6. 7.5CVE-2024-0804EPSS 0.5%2024-01-24

   Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

7. 6.5CVE-2024-0747EPSS 0.6%2024-01-23

   When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird…

8. 5.9CVE-2024-20926EPSS 1.0%2024-01-16

   Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle G…

9. 8.8CVE-2023-51748EPSS 0.3%2024-01-11

   ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.

10. 3.2CVE-2023-20573EPSS 0.3%2024-01-11

    A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debug information.

11. 4.9CVE-2023-4466EPSS 0.6%2023-12-29

    A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection …

12. 5.3CVE-2014-125107EPSS 0.8%2023-12-19

    A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of the component String Handler. The manipulation leads to protection mechanism failure. The attack may …

13. 9.8CVE-2023-31273EPSS 0.7%2023-11-14

    Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

14. 6.8CVE-2023-27383EPSS 0.4%2023-11-14

    Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a privileged user to potentially enable escalation of privilege via adjacent access.

15. 5.5CVE-2023-25080EPSS 0.2%2023-11-14

    Protection mechanism failure in some Intel(R) Distribution of OpenVINO toolkit software before version 2023.0.0 may allow an authenticated user to potentially enable information disclosure via local access.

16. 5.3CVE-2023-5875EPSS 0.3%2023-11-02

    Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server

17. 7.7CVE-2023-5557EPSS 0.8%2023-10-13

    A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

18. 9.8CVE-2023-45132EPSS 1.0%2023-10-11

    NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `Igno…

19. 5.3CVE-2023-45372EPSS 0.4%2023-10-09

    An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter…

20. 8.8CVE-2023-34984EPSS 0.7%2023-09-13

    A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.

21. 4.8CVE-2023-4039EPSS 1.0%Disputed2023-09-13

    A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This …

22. 7.2CVE-2023-41319EPSS 0.9%2023-09-06

    Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to …

23. 9.8CVE-2023-32493EPSS 0.8%2023-08-16

    Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exploit this vulnerability, leading to denial of service, information disclosure and remote execution.

24. 8.8CVE-2023-32006EPSS 1.5%2023-08-15

    The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in …

25. 7.8CVE-2023-34427EPSS 0.2%2023-08-11

    Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

26. 6.7CVE-2022-46329EPSS 0.3%2023-08-11

    Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.

27. 4.4CVE-2022-41984EPSS 0.2%2023-08-11

    Protection mechanism failure for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow a privileged user to potentially enable denial of service via local access.

28. 6.5CVE-2023-38157EPSS 2.5%2023-08-07

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

29. 7.5CVE-2023-35352EPSS 1.4%2023-07-11

    Windows Remote Desktop Security Feature Bypass Vulnerability

30. 9.6CVE-2023-33150EPSS 2.1%2023-07-11

    Microsoft Office Security Feature Bypass Vulnerability

31. 7.5CVE-2023-3089EPSS 0.5%2023-07-05

    A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

32. 8.8CVE-2021-31982EPSS 1.3%2023-07-01

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

33. 5.5CVE-2023-30757EPSS 0.1%2023-06-13

    A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All…

34. 5.3CVE-2023-30851EPSS 0.7%2023-05-25

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only on…

35. 8.8CVE-2022-41979EPSS 0.6%2023-05-10

    Protection mechanism failure in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.

36. 4.7CVE-2023-29354EPSS 1.4%2023-05-05

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

37. 6.1CVE-2023-28286EPSS 0.6%2023-04-27

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

38. 4.3CVE-2023-28284EPSS 0.8%2023-04-11

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

39. 7.8CVE-2023-21024EPSS 0.1%2023-03-24

    In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

40. 5.3CVE-2023-0085EPSS 0.7%2023-03-02

    The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submis…

41. 9.9CVE-2023-25765EPSS 1.1%2023-02-15

    In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute…

42. 9.1CVE-2022-48290EPSS 0.4%2023-02-09

    The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity.

43. 7.5CVE-2022-48287EPSS 0.4%2023-02-09

    The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data integrity.

44. 7.8CVE-2023-0002EPSS 0.3%2023-02-08

    A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.

45. 7.8CVE-2023-20919EPSS 0.1%2023-01-26

    In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User inter…

46. 6.5CVE-2023-23589EPSS 0.9%2023-01-14

    The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.

47. 5.5CVE-2021-26355EPSS 0.2%2023-01-11

    Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.

48. 4.3CVE-2023-0141EPSS 0.6%2023-01-10

    Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

49. 6.5CVE-2023-0131EPSS 0.6%2023-01-10

    Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. (Chromium security severity: Medium)

50. 7.5CVE-2022-46762EPSS 0.5%2023-01-06

    The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.