cve.bz

CWE-693: Protection Mechanism Failure, page 17

Filter

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

What the weakness is: CWE-693 at MITRE

Ask an AI about CWE-693

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-693: Protection Mechanism Failure and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/693.html and https://cve.bz/cve/cwe/693?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2022-47544EPSS 0.7%

    An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.

  2. 9.6CVE-2022-26384EPSS 1.0%

    If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the s…

  3. 8.8CVE-2022-22761EPSS 0.8%

    Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thun…

  4. 9.6CVE-2022-22759EPSS 0.8%

    If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's san…

  5. 3.3CVE-2022-20562EPSS 0.2%

    In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interac…

  6. 6.5CVE-2022-46698EPSS 1.0%

    A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose se…

  7. 7.8CVE-2022-42848EPSS 0.3%

    A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.

  8. 5.5CVE-2022-42821EPSS 3.9%

    A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks.

  9. 4.8CVE-2022-32537EPSS 0.3%

    A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components. Exploitation requires nearby wireless …

  10. 4.3CVE-2021-31608EPSS 0.5%

    Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.

  11. 8.8CVE-2022-33942EPSS 0.6%

    Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

  12. 9.8CVE-2022-27516EPSS 0.7%

    User login brute force protection functionality bypass

  13. 7.8CVE-2022-42801EPSS 0.6%

    A logic issue was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1. An app may be able to execute arbitrary code wi…

  14. 7.5CVE-2022-32910EPSS 1.2%

    A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Security Update 2022-005 Catalina. An archive may be able to bypass Gatekeeper.

  15. 5.3CVE-2022-43435EPSS 0.8%

    Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

  16. 5.3CVE-2022-43434EPSS 0.8%

    Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

  17. 4.3CVE-2022-43433EPSS 0.6%

    Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

  18. 4.3CVE-2022-43432EPSS 0.7%

    Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

  19. 5.3CVE-2022-43424EPSS 0.8%

    Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system p…

  20. 5.3CVE-2022-43422EPSS 0.8%

    Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properti…

  21. 5.3CVE-2022-21626EPSS 2.4%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM Enterprise Editio…

  22. 5.5CVE-2022-20464EPSS 0.1%

    In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interac…

  23. 7.5CVE-2022-39011EPSS 0.5%

    The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause unauthorized access to the HISP module.

  24. 9.8CVE-2022-39266EPSS 1.3%

    isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and ru…

  25. 6.5CVE-2022-3056EPSS 1.1%

    Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page.

  26. 6.5CVE-2022-3044EPSS 1.1%

    Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

  27. 10.0CVE-2022-32845EPSS 5.4%

    This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to break out of its sandbox.

  28. 7.8CVE-2022-32802EPSS 0.4%

    A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously crafted file may lead to arbitrary code execution.

  29. 8.8CVE-2022-26696EPSS 0.3%

    This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.

  30. 4.4CVE-2021-33081EPSS 0.2%

    Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.

  31. 4.4CVE-2021-33079EPSS 0.2%

    Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.

  32. 7.5CVE-2022-39957EPSS 1.0%

    The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on th…

  33. 9.8CVE-2022-36085EPSS 1.6%

    Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and…

  34. 10.0CVE-2022-35978EPSS 3.1%

    Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as t…

  35. 7.3CVE-2022-33631EPSS 0.8%

    Microsoft Excel Security Feature Bypass Vulnerability

  36. 9.8CVE-2022-31479EPSS 2.4%

    An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Co…

  37. 7.8CVE-2022-26774EPSS 0.3%

    A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.

  38. 4.1CVE-2022-20805EPSS 0.2%

    A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerab…

  39. 8.8CVE-2021-32960EPSS 2.4%

    Rockwell Automation FactoryTalk Services Platform v6.11 and earlier, if FactoryTalk Security is enabled and deployed contains a vulnerability that may allow a remote, authenticated attacker to bypass FactoryTalk Security policies based on …

  40. 9.8CVE-2021-27497EPSS 0.8%

    Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

  41. 9.8CVE-2022-20738EPSS 1.1%

    A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature. This vulnerability is due to insufficient restrictions in the file inspection feature. …

  42. 5.3CVE-2022-21283EPSS 3.8%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 an…

  43. 6.5CVE-2022-22152EPSS 0.8%

    A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing t…

  44. 4.9CVE-2021-36310EPSS 0.8%

    Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A high-privileged API user may potentially exploit this vulnerability, leading to a denial of ser…

  45. 5.5CVE-2020-12954EPSS 0.2%

    A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification.

  46. 5.3CVE-2021-35556EPSS 8.4%

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0…

  47. 5.9CVE-2021-31386EPSS 0.7%

    A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle (PitM) attacks against the device. This issue affects: Juniper Net…

  48. 6.5CVE-2021-31362EPSS 0.4%

    A Protection Mechanism Failure vulnerability in RPD (routing protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause established IS-IS adjacencies to go down by sending a spoo…

  49. 4.7CVE-2021-1616EPSS 1.2%

    A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass the ALG. This vulnerability is due to ins…

  50. 9.9CVE-2021-32835EPSS 4.6%

    Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code execution. This vulnerability is known to e…