Filtered by CWE-602
Filtered by vendor Subscriptions
Total 77 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-61197 1 Orban 3 Optimod 5750, Optimod 5950, Optimod Trio 2025-10-08 8.9 High
An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 allows a remote attacker to escalate privileges via the application stores user privilege/role information in client-side browser storage
CVE-2025-28168 1 Multiple File Upload Project 1 Multiple File Upload 2025-09-30 6.4 Medium
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.
CVE-2025-46591 1 Huawei 1 Harmonyos 2025-09-26 6.2 Medium
Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-9495 1 Viessmann 1 Vitogate 300 2025-09-24 N/A
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.
CVE-2024-52008 1 Ethyca 1 Fides 2025-09-23 8.8 High
Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the creation of accounts with passwords as short as a single character. When an email messaging provider is enabled and a new user account is created in the system, an invite email containing a special link is sent to the new user's email address. This link directs the new user to a page where they can set their initial password. While the user interface implements password complexity checks, these validations are only performed client-side. The underlying `/api/v1/user/accept-invite` API endpoint does not implement the same password policy validations. This vulnerability allows an invited user to set an extremely weak password for their own account during the initial account setup process. Therefore that specific user's account can be compromised easily by an attacker guessing or brute forcing the password. The vulnerability has been patched in Fides version `2.50.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no known workarounds for this vulnerability.
CVE-2025-53969 1 Cognex 2 In-sight Camera Firmware, In-sight Explorer 2025-09-19 8.8 High
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software, such as the In-Sight Explorer tool, to perform management operations such as changing network settings or modifying users' access to the device.
CVE-2025-54833 1 Opexus 1 Foiaxpress Public Access Link 2025-09-12 5.3 Medium
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.
CVE-2025-56694 1 Lumasoft 1 Fotoshare Cloud 2025-09-09 5.8 Medium
Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums.
CVE-2024-12603 2025-09-05 9.8 Critical
A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.
CVE-2025-8792 2 Litmus Project, Litmuschaos 2 Litmus, Litmus 2025-09-02 4.3 Medium
A vulnerability classified as problematic has been found in LitmusChaos Litmus up to 3.19.0. Affected is an unknown function. The manipulation leads to client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-1838 1 Ibm 1 Cloud Pak For Business Automation 2025-08-28 6.5 Medium
IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.
CVE-2024-39870 1 Siemens 1 Sinema Remote Connect Server 2025-08-27 6.3 Medium
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users outside of their own scope as well as to escalate privileges.
CVE-2025-33137 2 Ibm, Linux 2 Aspera Faspex, Linux Kernel 2025-08-26 7.1 High
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.
CVE-2025-27367 3 Ibm, Linux, Microsoft 3 Openpages With Watson, Linux Kernel, Windows 2025-08-24 5.3 Medium
IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved without storing the required fields.
CVE-2024-49824 1 Ibm 2 Robotic Process Automation, Robotic Process Automation For Cloud Pak 2025-08-18 6.5 Medium
IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation of client-side security enforcement.
CVE-2024-41751 1 Ibm 1 Smartcloud Analytics Log Analysis 2025-08-18 5.5 Medium
IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
CVE-2024-41750 1 Ibm 1 Smartcloud Analytics Log Analysis 2025-08-18 5.5 Medium
IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
CVE-2025-6025 2 Woocommerce, Wordpress 2 Woocommerce, Wordpress 2025-08-17 7.5 High
The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.
CVE-2025-36039 1 Ibm 1 Aspera Faspex 2025-08-06 6.5 Medium
IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms,
CVE-2024-52960 1 Fortinet 1 Fortisandbox 2025-07-24 4.2 Medium
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.