CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- w1.fi hostapd, wi-fi alliance hostapd with eap-pwd support, hostapd with sae support +10 more +12 moreThe implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit8.1 High
- w1.fi hostapd, wi-fi alliance hostapd with eap-pwd support, hostapd with sae support +10 more +12 moreThe implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-Commit8.1 High
- hashicorp consulHashiCorp Consul vulnerable to Origin Validation Error7.4 High
- mozilla firefoxIf WebRTC permission is requested from documents with data: or blob: URLs, the permission...5.3 Medium
- mozilla firefoxThe Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content...7.4 High
- mozilla firefoxCross-origin images can be read in violation of the same-origin policy by exporting an image...5.3 Medium
- google chrome, debian linux, fedoraproject fedora +3 more +5 moreInsufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a...6.5 Medium
- amazon fire osAmazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms...7.4 High
- yiiframework yiiYii Incorrectly Implements CORS5.9 Medium
- go cors project corsgithub.com/gofiber/fiber/v2 vulnerable to Origin Validation Error5.9 Medium
- google chromeA missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81...6.5 Medium
- logitech harmony hub, harmony hub firmware +1 moreThe Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA same-origin policy violation allowing the theft of cross-origin URL entries when using the...6.5 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe internal WebBrowserPersist code does not use correct origin context for a resource being...6.5 Medium
- auto-maskin dcu-210e, marine pro observer android app, rp-210e +2 more +4 moreThe Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, resu…9.1 Critical
- apple icloud, itunes, safari +1 more +3 moreA cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of...8.1 High
- mcafee application control (mac), application change control +1 moreMcAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation allowing the theft of cross-origin URL entries when using a meta...6.5 Medium
- epson wf-2750 firmwareEPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates...7.5 High
- insteon, insteon hub firmware +1 moreAn exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware...8.7 High
- microsoft edgeA security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of...4.3 Medium
- advantech webaccess, webaccess dashboard, webaccess scada +1 more +3 moreIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior,...6.1 Medium
- mozilla firefox, firefox esr, canonical ubuntu linux +7 more +9 moreSame-origin protections for the PDF viewer can be bypassed, allowing a malicious site to...7.5 High
- microsoft edgeA security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of...4.3 Medium
- google androidIn the getHost() function of UriTest.java, there is the possibility of incorrect web origin...9.8 Critical
- redhat libvirt, canonical ubuntu linux, debian linux +4 more +6 moreutil/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which...7.8 High
- grammarlyThe Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover...8.8 High
- mozilla firefox, canonical ubuntu linux +1 moreWebExtensions with the "ActiveTab" permission are able to access frames hosted within the active...9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreAn audio capture session can started under an incorrect origin from the site making the capture...5.3 Medium
- parity browserParity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and...5.3 Medium
- gnu guixsdGuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links...5.5 Medium
- red hat resteasy, redhat jboss enterprise application platform +1 moreInconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP7.5 High
- hackerone rubygems, canonical ubuntu linux, debian linux +6 more +8 moreRubyGems has Origin Validation Error vulnerability8.1 High
- mozilla firefoxA content security policy (CSP) "frame-ancestors" directive containing origins with paths allows...5.3 Medium
- mozilla firefoxResponse header name interning does not have same-origin protections and these headers are stored...7.5 High
- microsoft edgeMicrosoft Edge in Microsoft Windows 10 1703 allows an attacker to exploit a security feature...5.4 Medium
- microsoft edgeMicrosoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows...5.4 Medium
- microsoft edgeMicrosoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows...4.3 Medium
- apache nifiOrigin Validation Error in Apache NiFi7.5 High
- apache knoxApache Knox allows impersonation of users6.8 Medium
- accellion file transfer applianceAn issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request...8.8 High
- avahi, canonical ubuntu linux +1 moreavahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with...9.1 Critical
- google chromeSkia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same...7.5 High
- smiths-medical cadd-solis medication safety softwareAn issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0...8.5 High
- conversejs converse.jsUser Impersonation in converse.js5.9 Medium
- xabberAn incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- movimXMPP Clients User Impersonation Vulnerability in Movim Moxl5.9 Medium
- mcabberAn incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- jitsiAn incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- jappix project jappixAn incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a...5.9 Medium
- Show moreLoading…