CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- psi-plus psi\+An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- profanity project profanityAn incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- poezio, sleekxmpp project sleekxmpp, slixmpp project slixmpp +2 moreSleekXMPP and Slixmpp Incorrect Implementation of Message Carbons5.9 Medium
- chatsecure, zom +1 moreAn incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- yaxim bruno, yaxim +1 moreAn incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- mozilla firefox, firefox esr, redhat enterprise linux desktop +4 more +6 moreThe Pocket toolbar button, once activated, listens for events fired from it's own pages but does...7.5 High
- mozilla firefox, firefox os, canonical ubuntu linux +12 more +14 moreThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS...8.8 High
- mozilla firefox, seamonkey, opensuse +4 more +6 moreThe (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla...6.8 Medium
- mozilla firefox, seamonkey, thunderbird +14 more +16 moreThe Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3,...7.5 High
- mozilla firefox, seamonkey, thunderbird +9 more +11 moreMozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1,...6.8 Medium
- google chromeGoogle Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via...6.8 Medium
- google chrome, apple iphone os, safari +2 moreGoogle Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via...6.8 Medium
- google chrome, apple iphone os, safari +1 more +3 moreGoogle Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via...6.8 Medium
- google chromeThe extension implementation in Google Chrome before 17.0.963.46 does not properly handle...6.8 Medium
- google chromeGoogle V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to bypass the...7.5 High
- redhat spacewalk-java, red hat enterprise linux 6, enterprise linux 7 +2 more +4 moreSpacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery6.8 Medium
- udev project udev, canonical ubuntu linux, debian linux +6 more +8 moreudev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which...7.2 High
- thekelleys dnsmasqDnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that...7.5 High
- freescripts visitorbook leFreeScripts VisitorBook LE (visitorbook.pl) logs the reverse DNS name of a visiting host, which...6.1 Medium
- sgi irixThe LDAP name service (nsd) in IRIX 6.5.19 and earlier does not properly verify if the...9.8 Critical
- microsoft windows 2000, windows nt +1 moreBy default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received...7.5 High
- microsoft windows 98, windows 2000, windows 98se +2 more +4 moreThe default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000,...9.8 Critical
- lynx project lynxLynx 2.x does not properly distinguish between internal and external HTML, which may allow a...7.8 High