Skip to content
Noroxi

CWE-602 · 161 records

Client-Side Enforcement of Server-Side Security

CVEs in this class

161 records

  • CVE-2026-64813
    40Plan

    In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

    CriticalCVSS 10.0No exploitEPSS 1%

    jetbrains · intellij ideaJul 23, 2026

  • CVE-2026-23478
    40Plan

    Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

    CriticalCVSS 10.0No exploitEPSS 0%

    cal · cal.comJan 13, 2026

  • CVE-2026-42160
    40Plan

    Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend

    CriticalCVSS 10.0No exploitEPSS 0%

    sovity · dataspace-portalMay 8, 2026

  • CVE-2025-51682
    39Monitor

    mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to adminis

    CriticalCVSS 9.8No exploitEPSS 2%

    mjobtime · mjobtimeDec 1, 2025

  • CVE-2025-10640
    39Monitor

    Missing Server-Side Authentication Checks in EfficientLab WorkExaminer Professional

    CriticalCVSS 9.8No exploitEPSS 1%

    efficientlab · workexaminer professionalOct 21, 2025

  • CVE-2025-27681
    39Monitor

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-

    CriticalCVSS 9.8No exploitEPSS 1%

    printerlogic · vasion printMar 5, 2025

  • CVE-2024-12603
    39Monitor

    A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.

    CriticalCVSS 9.8No exploitEPSS 1%

    tecno · com.transsion.applockDec 12, 2024

  • CVE-2023-0750
    39Monitor

    Yellowbrik PEC-1864 authentication bypass

    CriticalCVSS 9.8No exploitEPSS 0%

    lynx-technik · yellobrik pec 1864 firmwareApr 6, 2023

  • CVE-2025-28168
    39Monitor

    The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload.

    CriticalCVSS 9.8No exploitEPSS 0%

    multiple file upload project · multiple file uploadMay 5, 2025

  • CVE-2022-20658
    38Monitor

    Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability

    CriticalCVSS 9.6No exploitEPSS 1%

    cisco · unified contact center expressJan 14, 2022

  • CVE-2025-32469
    37Monitor

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGE

    CriticalCVSS 9.4No exploitEPSS 1%

    siemens · ruggedcom rox mx5000May 13, 2025

  • CVE-2025-33024
    37Monitor

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGE

    CriticalCVSS 9.4No exploitEPSS 1%

    siemens · ruggedcom rox mx5000May 13, 2025

  • CVE-2025-33025
    37Monitor

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGE

    CriticalCVSS 9.4No exploitEPSS 1%

    siemens · ruggedcom rox mx5000May 13, 2025

  • CVE-2024-23666
    36Monitor

    A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0

    HighCVSS 8.8Proof of conceptEPSS 3%

    fortinet · fortianalyzerNov 12, 2024

  • CVE-2022-1525
    36Monitor

    Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side Security

    CriticalCVSS 9.1No exploitEPSS 1%

    cognex · 3d-a1000 dimensioning system firmwareSep 6, 2022

  • CVE-2026-59504
    36Monitor

    Priority – CWE-602: Client-Side Enforcement of Server-Side Security

    CriticalCVSS 9.1No exploitEPSS 0%

    priority · portal generator addon to priority erp (developed by soft solutions)Aug 13, 2026

  • CVE-2026-25737
    36Monitor

    Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

    CriticalCVSS 9.0No exploitEPSS 0%

    budibase · budibaseMar 9, 2026

  • CVE-2017-12161
    35Monitor

    It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque

    HighCVSS 8.8No exploitEPSS 1%

    keycloak · keycloakFeb 21, 2018

  • CVE-2024-9844
    35Monitor

    Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticat

    HighCVSS 8.8No exploitEPSS 1%

    ivanti · connect secureDec 10, 2024

  • CVE-2024-31491
    35Monitor

    A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2

    HighCVSS 8.8No exploitEPSS 1%

    fortinet · fortisandboxMay 14, 2024

  • CVE-2024-28029
    35Monitor

    Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie

    HighCVSS 8.8No exploitEPSS 1%

    deltaww · diaenergieMar 21, 2024

  • CVE-2026-14086
    35Monitor

    Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a cra

    HighCVSS 8.8No exploitEPSS 0%

    google · chromeJun 30, 2026

  • CVE-2025-61197
    35Monitor

    An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26

    HighCVSS 8.9No exploitEPSS 0%

    Oct 6, 2025

  • CVE-2025-33137
    35Monitor

    IBM Aspera Faspex data modification

    HighCVSS 8.8No exploitEPSS 0%

    ibm · aspera faspexMay 22, 2025

  • CVE-2026-14041
    35Monitor

    Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation

    HighCVSS 8.8No exploitEPSS 0%

    google · chromeJun 30, 2026

All vulnerability classes