CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
From the CWE List. © The MITRE Corporation.
Newest
- corazawaf corazaOWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling5.8 Medium
- hydra-ecosystem hydraHydra: Mutable instantiate policy sets allow target blocklist bypass8.5 High
- google chromeProtection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed...6.5 Medium
- mozilla firefox, thunderbird +1 moreMitigation bypass in the File Handling component9.8 Critical
- docling, docling-project docling-slim +1 moreDocling: KServe v2 OCR engine does not enforce enable_remote_services2.2 Low
- imagemagickImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE1.8 Low
- axiosAxios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges6.9 Medium
- apache wss4jApache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference7.5 High
- containers podmanPodman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation10.0 Critical
- electronElectron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions8.2 High
- electronElectron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab8.2 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component9.6 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Bookmarks & History component9.6 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Service Workers component8.8 High
- mozilla firefox, thunderbird +1 moreSandbox escape in the Graphics component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the Security: Process Sandboxing component9.6 Critical
- axiosAxios: Fetch Adapter Header Injection via Inherited FormData getHeaders6.9 Medium
- stoatchatstoatchat before 0.15.5 Local Filesystem Read via SVG8.8 High
- invoiceplaneInvoicePlane: Remote Code Execution via Writable Templates Directory9.1 Critical
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form5.3 Medium
- apache sling security, apache software foundation sling security bundle +1 moreApache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource6.5 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulnerability6.1 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)8.3 High
- notepad-plus-plusNotepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog6.7 Medium
github.com/falcosecurity/plugins/plugins/k8sauditGo,github.com/falcosecurity/plugins/plugins/k8saudit-aksGo,github.com/falcosecurity/plugins/plugins/k8saudit-eksGo +2 more +4 morek8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers4.3 Medium- 1panel-dev maxkbMaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)6.3 Medium
- 1panel-dev maxkbMaxKB: Sandbox escape via unhooked fexecve6.3 Medium
- patriksimek vm2vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species10.0 Critical
- patriksimek vm2vm2 NodeVM before 3.12.1 Remote Code Execution via child_process10.0 Critical
- john darrel hide my wp ghostWP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check5.3 Medium
- john darrel hide my wp ghostWP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters5.3 Medium
- midnightbsd mportmport audit can inspect the wrong package when options are present2.0 Low
- patriksimek vm2vm2 before 3.11.8 allowAsync Bypass via Promise Thenable7.1 High
- patriksimek vm2vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming10.0 Critical
- patriksimek vm2vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor6.3 Medium
- patriksimek vm2vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test9.4 Critical
- patriksimek vm2vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector9.3 Critical
- patriksimek vm2vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite9.4 Critical
- patriksimek vm2vm2 3.11.6 Remote Code Execution via Promise call/apply10.0 Critical
- patriksimek vm2vm2 before 3.11.8 Sandbox Escape RCE via AggregateError9.5 Critical
- patriksimek vm2vm2 before 3.11.8 Information Disclosure via util.getCallSites6.9 Medium
- yahoo cmakCMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes5.3 Medium
- cisco secure firewall adaptive security appliance (asa) software, secure firewall management center (fmc), secure firewall threat defense (ftd) software +2 moreCisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Protection Mechanism Failure Vulnerabiliti…9.6 Critical
- zopefoundation accesscontrolZope AccessControl: Information disclosure through Python string `format` and `format_map` functions6.8 Medium
- zopefoundation restrictedpythonRestrictedPython: Sandbox escape via string.Formatter field resolution8.4 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from...7.5 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy...8.8 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations...8.8 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called...8.8 High
- No product listedAn issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34...8.4 High
- Show moreLoading…