CWE-693 Protection Mechanism Failure
pillarThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
01
child weaknesses
More specific entries beneath this one.
02
vulnerabilities (1059)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-58704US | —OT critical | KEV | ||
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional… | ||||
| CVE-2026-32202US | —OT critical | KEV | ||
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-21513US | —OT critical | KEV | ||
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-21510US | —OT critical | KEV | ||
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2025-40536US | critical9.8OT critical | KEV | ||
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain… | ||||
| CVE-2025-0411US | high7.0OT critical | KEV | ||
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User i… | ||||
| CVE-2024-38226US | —OT critical | KEV | ||
Microsoft Publisher Security Feature Bypass Vulnerability | ||||
| CVE-2024-38217US | —OT critical | KEV | ||
Windows Mark of the Web Security Feature Bypass Vulnerability | ||||
| CVE-2024-38213US | —OT critical | KEV | ||
Windows Mark of the Web Security Feature Bypass Vulnerability | ||||
| CVE-2024-29988US | —OT critical | KEV | ||
SmartScreen Prompt Security Feature Bypass Vulnerability | ||||
| CVE-2024-21412US | —OT critical | KEV | ||
Internet Shortcut Files Security Feature Bypass Vulnerability | ||||
| CVE-2019-1003030US | critical9.9OT critical | KEV | ||
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allo… | ||||
| CVE-2019-1003029US | critical9.9OT critical | KEV | ||
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, sr… | ||||
| CVE-2013-2465US | high10.0OT critical | KEV | ||
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and Ope… | ||||
| CVE-2013-0431US | medium5.0OT critical | KEV | ||
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the… | ||||
| CVE-2019-1003000US | high8.8 | Exploit | ||
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows… | ||||
| CVE-2023-22809US | high7.8 | Exploit | ||
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a lo… | ||||
| CVE-2019-1003005US | high8.8 | Exploit | ||
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.jav… | ||||
| CVE-2022-35978US | critical10.0 | Exploit | ||
Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to di… | ||||
| CVE-2026-92956US | critical10.0 | Exploit | ||
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.ins… | ||||
03
attack patterns (17)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan