# CWE-602. Every Advisory and CVE whose sources give the weakness CWE-602, newest first. ## Records, newest first (an older page) - [IBM OpenPages with Watson improper input validation](https://agentprime.io/advisories/CVE-2025-27367.md) `CVE-2025-27367` · CVE record: IBM OpenPages with Watson · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-602 - [Ivanti Connect Secure: Improper access control in the certificate management component of Ivanti Connect Secure…](https://agentprime.io/advisories/CVE-2025-5450.md) `CVE-2025-5450` · CVE record: Ivanti Connect Secure and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-602 - [Siemens RUGGEDCOM ROX MX5000: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5)…](https://agentprime.io/advisories/CVE-2025-40591.md) `CVE-2025-40591` · CVE record: Siemens RUGGEDCOM ROX MX5000 and 4 more · CVSS 8.3 High · Not analysed yet · Published 10 Jun 2025 · Tags: CWE-602 - [Salesforce OmniStudio: Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio…](https://agentprime.io/advisories/CVE-2025-43699.md) `CVE-2025-43699` · CVE record: Salesforce OmniStudio · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: CWE-602 - [Client-side enforcement of server-side security issue exists in wivia 5 all versions.](https://agentprime.io/advisories/CVE-2025-47697.md) `CVE-2025-47697` · CVE record: UCHIDA YOKO CO., LTD. wivia 5 · CVSS 6.9 Medium · Not analysed yet · Published 30 May 2025 · Tags: CWE-602 - [IBM Aspera Faspex data modification](https://agentprime.io/advisories/CVE-2025-33137.md) `CVE-2025-33137` · CVE record: IBM Aspera Faspex · CVSS 7.1 High · Not analysed yet · Published 22 May 2025 · Tags: CWE-602 - [Cisco Unified Intelligence Center Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2025-20113.md) `CVE-2025-20113` · CVE record: Cisco Cisco Unified Contact Center Express and 1 more · CVSS 7.1 High · Not analysed yet · Published 21 May 2025 · Tags: CWE-602 - [Siemens RUGGEDCOM ROX MX5000: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5)…](https://agentprime.io/advisories/CVE-2025-33025.md) `CVE-2025-33025` · CVE record: Siemens RUGGEDCOM ROX MX5000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2025 · Tags: CWE-602 - [Siemens RUGGEDCOM ROX MX5000: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5)…](https://agentprime.io/advisories/CVE-2025-33024.md) `CVE-2025-33024` · CVE record: Siemens RUGGEDCOM ROX MX5000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2025 · Tags: CWE-602 - [Siemens RUGGEDCOM ROX MX5000: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5)…](https://agentprime.io/advisories/CVE-2025-32469.md) `CVE-2025-32469` · CVE record: Siemens RUGGEDCOM ROX MX5000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2025 · Tags: CWE-602 - [Dígitro NGC Explorer Password Transmission client-side enforcement of server-side security](https://agentprime.io/advisories/CVE-2025-4527.md) `CVE-2025-4527` · CVE record: Dígitro NGC Explorer · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2025 · Tags: CWE-602 - [Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2025-46591.md) `CVE-2025-46591` · CVE record: Huawei HarmonyOS · CVSS 6.2 Medium · Not analysed yet · Published 6 May 2025 · Tags: CWE-602 - [Multi Uploaders Multiple File Upload: The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to…](https://agentprime.io/advisories/CVE-2025-28168.md) `CVE-2025-28168` · CVE record: Multi Uploaders Multiple File Upload · CVSS 6.4 Medium · Not analysed yet · Published 5 May 2025 · Tags: CWE-602 - [IBM Cloud Pak for Business Automation denial of service](https://agentprime.io/advisories/CVE-2025-1838.md) `CVE-2025-1838` · CVE record: IBM Cloud Pak for Business Automation · CVSS 6.5 Medium · Not analysed yet · Published 3 May 2025 · Tags: CWE-602 - [Captcha Bypass Vulnerability in Meon KYC solutions](https://agentprime.io/advisories/CVE-2025-42601.md) `CVE-2025-42601` · CVE record: Meon KYC solutions · CVSS 8.2 High · Not analysed yet · Published 23 Apr 2025 · Tags: CWE-602 - [W.](https://agentprime.io/advisories/CVE-2025-32808.md) `CVE-2025-32808` · CVE record: W. W. Norton InQuizitive · CVSS 7.7 High · Not analysed yet · Published 11 Apr 2025 · Tags: CWE-602 - [In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.](https://agentprime.io/advisories/CVE-2025-32359.md) `CVE-2025-32359` · CVE record: Zammad Zammad · CVSS 4.8 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: CWE-602 - [Fortinet FortiSandbox: A client-side enforcement of server-side security vulnerability \[CWE-602\] in Fortinet…](https://agentprime.io/advisories/CVE-2024-52960.md) `CVE-2024-52960` · CVE record: Fortinet FortiSandbox · CVSS 4.2 Medium · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-602 - [An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and…](https://agentprime.io/advisories/CVE-2025-25497.md) `CVE-2025-25497` · CVE record · CVSS 8.1 High · Not analysed yet · Published 6 Mar 2025 · Tags: CWE-602 - [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-2022-004.](https://agentprime.io/advisories/CVE-2025-27681.md) `CVE-2025-27681` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: CWE-602 - [IBM Robotic Process Automation security bypass](https://agentprime.io/advisories/CVE-2024-49824.md) `CVE-2024-49824` · CVE record: IBM Robotic Process Automation and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Jan 2025 · Tags: CWE-602 - [Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length](https://agentprime.io/advisories/GHSA-9v8m-qv22-f268.md) `GHSA-9v8m-qv22-f268`, `CVE-2025-23041` · NuGet `Umbraco.Forms` and 1 more: affected `<10.5.7 || >=11.0.0-rc1, <13.2.2 || >=14.0.0-beta001, <14.1.2`, fixed in `10.5.7`, `13.2.2`, `14.1.2` · CVSS 5.8 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-20, CWE-602 - [TECNO com.transsion.applock: A logic vulnerability in the the mobile application (com.transsion.applock) can lead to…](https://agentprime.io/advisories/CVE-2024-12603.md) `CVE-2024-12603` · CVE record: TECNO com.transsion.applock · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Dec 2024 · Tags: CWE-602 - [Ivanti Connect Secure: Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure…](https://agentprime.io/advisories/CVE-2024-9844.md) `CVE-2024-9844` · CVE record: Ivanti Connect Secure · CVSS 7.1 High · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-602 - [Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API](https://agentprime.io/advisories/GHSA-v7vm-rhmg-8j2r.md) `GHSA-v7vm-rhmg-8j2r`, `CVE-2024-52008`, `PYSEC-2026-1349` · PyPI `ethyca-fides`: affected `<2.50.0`, fixed in `2.50.0` · CVSS 2.0 Low · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-602 - [Axis Communications AB AXIS Camera Station Pro: Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is…](https://agentprime.io/advisories/CVE-2024-6831.md) `CVE-2024-6831` · CVE record: Axis Communications AB AXIS Camera Station Pro and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-602 - [Fortinet FortiManager: A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at…](https://agentprime.io/advisories/CVE-2024-23666.md) `CVE-2024-23666` · CVE record: Fortinet FortiManager and 1 more · CVSS 7.1 High · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-602 - [Cisco Identity Services Engine Authorization Bypass Vulnerability](https://agentprime.io/advisories/CVE-2024-20476.md) `CVE-2024-20476` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2024 · Tags: CWE-602 - [IBM Business Automation Workflow improper input validation](https://agentprime.io/advisories/CVE-2024-43188.md) `CVE-2024-43188` · CVE record: IBM Business Automation Workflow · CVSS 4.9 Medium · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-602 - [Ivanti Workspace Control: Insufficient server-side controls in the management console of Ivanti Workspace Control…](https://agentprime.io/advisories/CVE-2024-44106.md) `CVE-2024-44106` · CVE record: Ivanti Workspace Control · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-602 - [CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security](https://agentprime.io/advisories/CVE-2024-42340.md) `CVE-2024-42340` · CVE record: CyberArk CyberArk Identity Management · CVSS 8.3 High · Not analysed yet · Published 25 Aug 2024 · Tags: CWE-602 - [Cross-site scripting in Honeywell PC42t, PC42tp, and PC42d (Common Firmware)](https://agentprime.io/advisories/CVE-2024-6620.md) `CVE-2024-6620` · CVE record: Honeywell PC42t, PC42tp, and PC42d (Common Firmware) · CVSS 3.5 Low · Not analysed yet · Published 29 Jul 2024 · Tags: Cross-site scripting (XSS), CWE-602 - [A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).](https://agentprime.io/advisories/CVE-2024-39870.md) `CVE-2024-39870` · CVE record: Siemens SINEMA Remote Connect Server · CVSS 7.1 High · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-602 - [Fortinet FortiPortal: A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0…](https://agentprime.io/advisories/CVE-2023-48789.md) `CVE-2023-48789` · CVE record: Fortinet FortiPortal · CVSS 4.1 Medium · Not analysed yet · Published 3 Jun 2024 · Tags: CWE-602 - [WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerability](https://agentprime.io/advisories/CVE-2024-32685.md) `CVE-2024-32685` · CVE record: Wpmet Wp Ultimate Review · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2024 · Tags: CWE-602 - [WordPress Zero Spam for WordPress plugin <= 5.5.6 - Bypass Spam Protection vulnerability](https://agentprime.io/advisories/CVE-2024-32521.md) `CVE-2024-32521` · CVE record: Highfivery LLC Zero Spam · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2024 · Tags: CWE-602 - [WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability](https://agentprime.io/advisories/CVE-2024-32512.md) `CVE-2024-32512` · CVE record: weForms weForms · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2024 · Tags: CWE-602 - [Fortinet FortiSandbox: A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox…](https://agentprime.io/advisories/CVE-2024-31491.md) `CVE-2024-31491` · CVE record: Fortinet FortiSandbox · CVSS 8.6 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-602 - [Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie](https://agentprime.io/advisories/CVE-2024-28029.md) `CVE-2024-28029` · CVE record: Delta Electronics DIAEnergie · CVSS 8.8 High · Not analysed yet · Published 21 Mar 2024 · Tags: CWE-602 - [UserPro <= 5.1.6 - Disabled Membership Registration Bypass](https://agentprime.io/advisories/CVE-2024-0701.md) `CVE-2024-0701` · CVE record: UserPro - Community and User Profile WordPress Plugin · CVSS 5.3 Medium · Not analysed yet · Published 5 Feb 2024 · Tags: CWE-602 - [Gallagher Command Centre: Client-Side enforcement of Server-Side security for the Command Centre server could be…](https://agentprime.io/advisories/CVE-2023-23570.md) `CVE-2023-23570` · CVE record: Gallagher Command Centre · CVSS 5.4 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-602 - [Fortinet FortiAnalyzer: A client-side enforcement of server-side security \[CWE-602\] vulnerability in Fortinet…](https://agentprime.io/advisories/CVE-2023-42787.md) `CVE-2023-42787` · CVE record: Fortinet FortiAnalyzer and 3 more · CVSS 6.2 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-602 - [Insufficient Validation on Override Codes for Always-Enabled WARP Mode](https://agentprime.io/advisories/CVE-2023-3747.md) `CVE-2023-3747` · CVE record: Cloudflare WARP Client · CVSS 5.5 Medium · Not analysed yet · Published 7 Sept 2023 · Tags: CWE-602 - [Zoom Video Communications, Inc. Zoom Clients: Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow…](https://agentprime.io/advisories/CVE-2023-39218.md) `CVE-2023-39218` · CVE record: Zoom Video Communications, Inc. Zoom Clients · CVSS 6.1 Medium · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-602 - [Foundry workspace-server Developer Mode Authorization Bypass](https://agentprime.io/advisories/CVE-2023-30955.md) `CVE-2023-30955` · CVE record: Palantir com.palantir.workspace:workspace · CVSS 4.3 Medium · Not analysed yet · Published 29 Jun 2023 · Tags: CWE-602 - [Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20172.md) `CVE-2023-20172` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 5.4 Medium · Not analysed yet · Published 18 May 2023 · Tags: CWE-602 - [Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20171.md) `CVE-2023-20171` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 5.4 Medium · Not analysed yet · Published 18 May 2023 · Tags: CWE-602 - [Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20106.md) `CVE-2023-20106` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 5.4 Medium · Not analysed yet · Published 18 May 2023 · Tags: CWE-602 - [Yellowbrik PEC-1864 authentication bypass](https://agentprime.io/advisories/CVE-2023-0750.md) `CVE-2023-0750` · CVE record: Lynx Technik AG Yellowbrik · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Apr 2023 · Tags: CWE-602 - [Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77…](https://agentprime.io/advisories/CVE-2023-0704.md) `CVE-2023-0704` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2023 · Tags: CWE-602 - [PrivateContent <= 8.4.3 - Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2023-0581.md) `CVE-2023-0581` · CVE record: LCWeb PrivateContent · CVSS 5.3 Medium · Not analysed yet · Published 30 Jan 2023 · Tags: CWE-602 - [Google Chrome: Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to…](https://agentprime.io/advisories/CVE-2022-3310.md) `CVE-2022-3310` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 1 Nov 2022 · Tags: CWE-602 - [Google Chrome: Insufficient policy enforcement in developer tools in Google Chrome prior to…](https://agentprime.io/advisories/CVE-2022-3308.md) `CVE-2022-3308` · CVE record: Google Chrome · CVSS 7.4 High · Not analysed yet · Published 1 Nov 2022 · Tags: CWE-602 - [Google Chrome: Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52…](https://agentprime.io/advisories/CVE-2022-3047.md) `CVE-2022-3047` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2022 · Tags: CWE-602 - [Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side Security](https://agentprime.io/advisories/CVE-2022-1525.md) `CVE-2022-1525` · CVE record: Cognex 3D-A1000 Dimensioning System · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2022 · Tags: CWE-602 - [Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability.](https://agentprime.io/advisories/CVE-2022-31233.md) `CVE-2022-31233` · CVE record: Dell Unisphere for PowerMax · CVSS 6.3 Medium · Not analysed yet · Published 31 Aug 2022 · Tags: CWE-602 - [Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability.](https://agentprime.io/advisories/CVE-2021-36338.md) `CVE-2021-36338` · CVE record: Dell Unisphere for PowerMax · CVSS 6.3 Medium · Not analysed yet · Published 21 Jan 2022 · Tags: CWE-602 - [Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2022-20658.md) `CVE-2022-20658` · CVE record: Cisco Cisco Unified Contact Center Domain Manager · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2022 · Tags: CWE-602 - [Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability.](https://agentprime.io/advisories/CVE-2021-21531.md) `CVE-2021-21531` · CVE record: Dell Unisphere for PowerMax · CVSS 8.1 High · Not analysed yet · Published 30 Apr 2021 · Tags: CWE-602 - [Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability.](https://agentprime.io/advisories/CVE-2021-21544.md) `CVE-2021-21544` · CVE record: Dell Integrated Dell Remote Access Controller (iDRAC) · CVSS 2.7 Low · Not analysed yet · Published 30 Apr 2021 · Tags: CWE-602 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .