CWE-602: Client-Side Enforcement of Server-Side Security
The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a...8.8 High
- google chromeInsufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a...8.8 High
- google chromeInsufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47...6.5 Medium
- google chromeInsufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47...6.5 Medium
- google chromeInsufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7871.47...5.5 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInsufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a...8.8 High
- google chromeInsufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a...9.6 Critical
- google chromeInsufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an...6.5 Medium
- google chromeInsufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47...6.5 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence6.5 Medium
- johnson & johnson audit tracking management systemJohnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of...7.5 High
- johnson & johnson campus recruitingJohnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by...7.5 High
- cap-go capgoCapgo - Two-Factor Authentication Bypass via Organization Management API7.1 High
- nanocoai nanoclawNanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action6.8 Medium
- civilian board of contract appeals electronic docketing system (eds), government accountability office electronic protest docketing system (epds) +1 moreU.S. GAO EPDS and CBCA EDS client-based privilege escalation8.7 High
- google chromeInsufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53...6.5 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...4.3 Medium
- google chromeInsufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed...8.3 High
- google chromeInsufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote...6.3 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an...8.8 High
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...4.3 Medium
- google chromeInsufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53...6.5 Medium
- google chromeInsufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...6.5 Medium
- google chromeInsufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53...8.1 High
- dfir-iris iris-webIris has an Open Redirect issue4.7 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Open WebUI Improper Authorization Control7.3 High
- sovity dataspace-portalData Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend10.0 Critical
- jupyter jupyterlab, red hat migration toolkit for applications 8.2, openshift ai (rhoai) +1 more +3 moreJupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.8.8 High
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an...6.5 Medium
- frappe learning, lms +1 moreFrappe Learning Management System has Client-Side Manipulation of Quiz Scores5.3 Medium
- oretnom23 loan management systemA Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to...6.5 Medium
- oretnom23 loan management systemA Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to...6.5 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a...4.3 Medium
- budibaseBudibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)8.9 High
- filebrowserFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info7.5 High
- elated-themes frappeFrappe: Broken Access Control in DocShare7.1 High
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies4.8 Medium
- gtsteffaniak filebrowser, filebrowser quantum +1 moreFileBrowser Quantum: Password Protection Not Enforced on Shared File Links7.1 High
- dell wyse management suiteDell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of...2.7 Low
- ibm applinxMultiple vulnerabilities found in IBM ApplinX.3.1 Low
- bdthemes spin wheel – interactive spinning wheel that offers couponsSpin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter5.3 Medium
- cal cal.comCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback10.0 Critical
- ibm db2 intelligence centerClient-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center4.3 Medium
- ibm cognos controller, controller +1 moreIBM Controller Validation Bypass2.7 Low
- 1panel-dev 1panel1Panel – CAPTCHA Bypass via Client-Controlled Flag7.5 High
- Show moreLoading…