TYPE DE FAIBLESSE

CWE-602

102 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-602 (en anglais) →

CVE-2026-42329Les plateformes collaboratives web Iris antérieures à la version 2.4.28 sont vulnérables à une redirection ouverte. Un attaquant distant non authentifié peut inciter un utilisateur… 4.7 MOYENNE

CVE-2026-5901Les utilisateurs de Google Chrome sont concernés s'ils installent une extension de navigateur malveillante. Un attaquant peut utiliser une telle extension pour contourner les restr… 6.5 MOYENNE

CVE-2026-39415Les versions de Frappe Learning Management System (LMS) antérieures à la version 2.46.0 permettent aux étudiants de manipuler leurs propres scores de quiz avant de les soumettre. C… 5.3 MOYENNE

CVE-2026-30522Le système de gestion de prêts SourceCodester Loan Management System v1.0 est affecté par une faille dans la gestion des pénalités des plans de prêt. Un utilisateur authentifié dis… 6.5 MOYENNE

CVE-2026-30521Les utilisateurs du système de gestion de prêts SourceCodester Loan Management System v1.0 peuvent voir leurs plans de prêt manipulés si un attaquant possède un compte authentifié … 6.5 MOYENNE

CVE-2026-3941Les utilisateurs de Google Chrome sont concernés par une faille dans la politique de navigation des DevTools. Un attaquant distant peut contourner certaines restrictions de page s'… 4.3 MOYENNE

CVE-2026-30783Les clients RustDesk version 1.4.8 et antérieures, sur toutes les plateformes, sont sensibles à une faille d'abus de privilèges. Un utilisateur disposant déjà d'un accès de bas niv… 4.8 MOYENNE

CVE-2026-0808Les sites WordPress utilisant l'extension Spin Wheel (version 2.1.0 et versions antérieures) sont vulnérables à la manipulation des prix. Un attaquant distant non authentifié peut … 5.3 MOYENNE

CVE-2025-14687IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms. 4.3 MOYENNE

CVE-2025-12788The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions u… 5.3 MOYENNE

CVE-2025-36093IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle tech… 4.8 MOYENNE

CVE-2025-41402Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. Thi… 5.5 MOYENNE

CVE-2025-56694Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums. 5.8 MOYENNE

CVE-2025-54833OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brut… 6.9 MOYENNE

CVE-2025-36039IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms, 6.5 MOYENNE

CVE-2024-41751IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of se… 5.5 MOYENNE

CVE-2024-41750IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of se… 5.5 MOYENNE

CVE-2025-27367IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for … 5.3 MOYENNE

CVE-2025-5450Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote au… 6.3 MOYENNE

CVE-2025-43699Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts OmniStudio: before Spr… 5.3 MOYENNE

CVE-2025-47697Client-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated attacker may bypass authentication and operate the affected d… 6.9 MOYENNE

CVE-2025-46591Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service confidentiality. 6.2 MOYENNE

CVE-2025-28168The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solel… 6.4 MOYENNE

CVE-2025-1838IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation in an authoring user i… 6.5 MOYENNE

CVE-2025-32359In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate w… 4.8 MOYENNE

CVE-2024-52960A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attac… 4.3 MOYENNE

CVE-2024-49824IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23… 6.5 MOYENNE

CVE-2024-6831Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due to a client-side-onl… 4.4 MOYENNE

CVE-2024-20476A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management… 4.3 MOYENNE

CVE-2024-43188IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation. 4.9 MOYENNE

CVE-2023-48789A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests. 4.3 MOYENNE

CVE-2024-32685Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5. 5.3 MOYENNE

CVE-2024-32521Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a thro… 5.3 MOYENNE

CVE-2024-32512Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20. 5.3 MOYENNE

CVE-2024-0701The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce… 5.3 MOYENNE

CVE-2023-23570 Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Ga… 5.4 MOYENNE

CVE-2023-42787A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 m… 6.5 MOYENNE

CVE-2023-3747Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to… 5.5 MOYENNE

CVE-2023-39218Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access. 6.1 MOYENNE

CVE-2023-30955A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users … 4.3 MOYENNE

CVE-2023-20172Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To expl… 5.4 MOYENNE

CVE-2023-20171Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To expl… 5.4 MOYENNE

CVE-2023-20106Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To expl… 5.4 MOYENNE

CVE-2023-0704Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML pag… 6.5 MOYENNE

CVE-2023-0581The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due t… 5.3 MOYENNE

CVE-2022-3310Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass sam… 6.5 MOYENNE

CVE-2022-3047Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downlo… 6.5 MOYENNE

CVE-2022-31233Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate thei… 6.3 MOYENNE

CVE-2021-36338Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulnerability to escalate … 6.3 MOYENNE

CVE-2020-27268In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications al… 6.5 MOYENNE