Protection Mechanism Failure
CWE-693
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
We track 444 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.5. 14 have been exploited in real attacks.
Latest Protection Mechanism Failure vulnerabilities
- 9.8 Critical severity
HarmonyOS: Protection Mechanism Failure
Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.8 High severity
Android: Protection Mechanism Failure
In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not
- 7.8 High severity
Android: Protection Mechanism Failure
In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploi
- 7.8 High severity
Intel(R) OFU software: Protection Mechanism Failure
Protection mechanism failure in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 8.1 High severity
Microsoft Windows Internet Shortcut Files Security Feature Bypass Exploited
Internet Shortcut Files Security Feature Bypass Vulnerability
- 8.8 High severity
Linux Kernel: Protection Mechanism Failure
In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.
- 7.5 High severity
Chrome: Protection Mechanism Failure
Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Scalefusion: Protection Mechanism Failure
ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
- 9.8 Critical severity
Intel DCM software: Improper Privilege Management
Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
- 7.7 High severity
Red Hat Enterprise Linux 8: Protection Mechanism Failure
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- 9.8 Critical severity
naxsi: Protection Mechanism Failure
NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `IgnoreCIDR` rules. This o
- 8.8 High severity
FortiWeb: Protection Mechanism Failure
A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- 7.2 High severity
fides: Improper Control of Generation of Code
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP
- 9.8 Critical severity
PowerScale OneFS: Protection Mechanism Failure
Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exploit this vulnerability, leading to denial of service, information disclosure and remote execution.
- 8.8 High severity
Node: Protection Mechanism Failure
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lin
- 7.8 High severity
Intel(R) RealSense(TM) ID software for…: Protection Mechanism Failure
Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.5 High severity
openshift: Weak Password Requirements
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
- 8.8 High severity
Intel(R) DCM software: Protection Mechanism Failure
Protection mechanism failure in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.
- 7.8 High severity
Android: Protection Mechanism Failure
In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Andr
- 9.9 Critical severity
Jenkins Email Extension Plugin: Protection Mechanism Failure
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in th
- 9.1 Critical severity
HarmonyOS: Protection Mechanism Failure
The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity.
- 7.8 High severity
Cortex XDR agent: Protection Mechanism Failure
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.
- 7.8 High severity
Android: Protection Mechanism Failure
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed
- 9.6 Critical severity
Firefox: Protection Mechanism Failure
If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerab
- 8.8 High severity
Firefox: Protection Mechanism Failure
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and F
- 9.6 Critical severity
Firefox: Protection Mechanism Failure
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerabil
- 7.8 High severity
tvOS: Protection Mechanism Failure
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
- 8.8 High severity
Intel(R) DCM software: Protection Mechanism Failure
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- 7.8 High severity
macOS: Protection Mechanism Failure
A logic issue was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1. An app may be able to execute arbitrary code with kernel privileges.
- 7.5 High severity
macOS: Protection Mechanism Failure
A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Security Update 2022-005 Catalina. An archive may be able to bypass Gatekeeper.
- 7.5 High severity
HarmonyOS: Protection Mechanism Failure
The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause unauthorized access to the HISP module.
- 9.8 Critical severity
isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface.
isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in t
- 10.0 Critical severity
macOS: Protection Mechanism Failure
This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to break out of its sandbox.
- 7.8 High severity
macOS: Protection Mechanism Failure
A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously crafted file may lead to arbitrary code execution.
- 8.8 High severity
macOS: Protection Mechanism Failure
This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
- 7.5 High severity
ModSecurity Core Rule Set: Improper Encoding or Escaping of Output
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this res
- 9.8 Critical severity
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — b
- 10.0 Critical severity
minetest: Protection Mechanism Failure
Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is ex
- 9.8 Critical severity
LNL-X2210: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1
- 7.8 High severity
iTunes for Windows: Protection Mechanism Failure
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.