CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- apple ios, ipados, safari +1 more +3 moreA logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and...7.5 High
- damstratechnology smart assetAn issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource...9.8 Critical
- gradle enterpriseAn issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross...6.5 Medium
- wibu codemeterThis vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All...7.5 High
- robotemi temi firmwareTemi firmware 20190419.165201 does not properly verify that the source of data or communication...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy observing the stack trace for JavaScript errors in web workers, it was possible to leak the...6.5 Medium
- microsoft project, 365 apps, 365 apps for enterprise for 32-bit systems +3 more +5 moreA remote code execution vulnerability exists in Microsoft Project software when the software...7.8 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +19 more +21 moreA remote code execution vulnerability exists when the Windows font library improperly handles...8.8 High
- envoyproxy envoyTLS Validation Vulnerability in Envoy4.6 Medium
- mattermost desktopAn issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is...7.3 High
- typo3, typo3 cms +1 moreCross-Site Request Forgery in TYPO3 CMS8.0 High
- mozilla thunderbird, canonical ubuntu linux +1 moreBy encoding Unicode whitespace characters within the From email header, an attacker can spoof the...4.3 Medium
- ntp, debian linux, netapp all flash fabric-attached storage 8300 firmware +14 more +16 morentpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block...5.9 Medium
- zend zendtolib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded...7.5 High
- adobe magento, cardgate payments +1 moreOrigin Validation Error in Magento 28.1 High
- cardgate paymentsCardGate Payments plugin for WooCommerce does not validate request origin8.1 High
- ibm security secret serverIBM Security Secret Server 10.7 processes patches, image backups and other updates without...4.4 Medium
- apple icloud, icloud for windows, ipados +9 more +11 moreA logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7...7.8 High
- microsoft office online serverA spoofing vulnerability exists when Office Online Server does not validate origin in cross...5.4 Medium
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....9.8 Critical
- microsoft office online serverA spoofing vulnerability exists when Office Online does not validate origin in cross-origin...5.4 Medium
- openlambda project openlambdaOpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP...8.1 High
- w1.fi hostapdAn exploitable denial-of-service vulnerability exists in the 802.11w security state handling for...7.4 High
- google chrome, debian linux, fedoraproject fedora +4 more +6 moreIncorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker...6.5 Medium
- norton password managerNorton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing ...6.3 Medium
- norton password managerNorton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing ...6.3 Medium
- titanhq webtitanAn issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution...7.5 High
- huawei hisuite firmware, mate 20 firmware, p30 firmware +1 more +3 moreP30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193...5.5 Medium
- huawei hisuite firmware, mate 20 firmware, p30 firmware +1 more +3 moreP30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193...5.5 Medium
- microsoft office online serverA spoofing vulnerability exists when Office Online does not validate origin in cross-origin...5.4 Medium
- microsoft office online serverA spoofing vulnerability exists when Office Online does not validate origin in cross-origin...5.4 Medium
- microsoft sharepoint serverA security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An...5.5 Medium
- microsoft edge, edge (edgehtml-based) on windows 10 version 1607 for 32-bit systems, edge (edgehtml-based) on windows 10 version 1607 for x64-based systems +14 more +16 moreA security feature bypass vulnerability exists when Microsoft Edge improperly handles extension...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf two same-origin documents set document.domain differently to become cross-origin, it was...6.1 Medium
- zingbox inspectorA security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could...9.8 Critical
- solarwinds dameware mini remote controlThe Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication...9.8 Critical
- adobe flash player, flash player desktop runtime, debian linux +2 more +4 moreAdobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass...7.5 High
- google chromeInsufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote...6.5 Medium
- w1.fi hostapd, canonical ubuntu linux, debian linux +1 more +3 morehostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection...6.5 Medium
- adobe flash player, flash player desktop runtime +1 moreAdobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same...9.8 Critical
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +11 more +13 moreAn elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the...7.8 High
- dino, canonical ubuntu linux, debian linux +1 more +3 moreDino before 2019-09-10 does not properly check the source of a carbons message in module/xep...7.5 High
- dino, canonical ubuntu linux, debian linux +1 more +3 moreDino before 2019-09-10 does not properly check the source of an MAM message in module/xep...7.5 High
- eclipse paho java client, the eclipse foundation eclipse paho +1 moreImproper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library7.5 High
- google nest cam iq indoor firmwareAn exploitable denial-of-service vulnerability exists in the Weave error reporting functionality...7.5 High
- mozilla firefox, opensuse leap +1 moreA vulnerability exists during the installation of add-ons where the initial fetch ignored the...7.5 High
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote...6.5 Medium
- gemalto sentinel ldkGemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with...5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreImages from a different domain can be read using a canvas object in some circumstances. This...5.3 Medium
- printerlogic management software, print management +1 morePrinterLogic Print Management Software updates and executes the code without origin and code verification9.8 Critical
- Show moreLoading…