CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- glfusionglFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html...9.1 Critical
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS)...6.5 Medium
- mozilla firefoxWhen a user loaded a Web Extensions context menu, the Web Extension could access the post...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently...6.5 Medium
- freeswitchFreeSWITCH vulnerable to SIP digest leak for configured gateways5.8 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThrough use of reportValidity() and window.open(), a plain-text validation message could have...6.5 Medium
- elv elvishRemote code execution via the web UI backend of Elvish8.0 High
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote...4.3 Medium
- yandex browser, yandex n.v. browser for android +1 moreYandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar...7.3 High
- http4sDefault CORS config allows any origin with credentials9.1 Critical
- eclipse theia, the eclipse foundation eclipse theia +1 moreRemote code execution in Eclipse Theia8.8 High
- hedgedocXSS vector in slide mode speaker-view8.1 High
- ping identity rsa securid integration kitIn Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.7.5 High
- microsoft onefuzzImproper Authorization and Origin Validation Error in OneFuzz10.0 Critical
- google chrome, fedoraproject fedora +1 moreIncorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote...6.5 Medium
- npupnp project npupnpThe server in npupnp before 4.1.4 is affected by DNS rebinding in the embedded web server ...8.8 High
- apache maven, oracle financial services analytical applications infrastructure, goldengate big data and application adapters +1 more +3 moreblock repositories using http by default9.1 Critical
- github.com/gorilla/handlers, gorillatoolkit handlers +1 moreImproper access control in github.com/gorilla/handlers9.8 Critical
- devolutions serverAn overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS...6.5 Medium
- bitdefender safepaySame-origin policy vulnerability in Bitdefender Safepay5.5 Medium
- mozilla firefoxA malicious extension with the 'search' permission could have installed a new search engine whose...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed...6.5 Medium
- cisco nx-os system software in aci mode, nx-os +1 moreCisco Nexus 9000 Series Fabric Switches ACI Mode Link Layer Discovery Protocol Port Denial of Service Vulnerability4.7 Medium
- acronis cyber protectAn issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the...7.5 High
- pelco digital sentry serverDSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write...8.1 High
- containers podmanPodman Origin Validation Error5.9 Medium
socialiteproviders/steamPackagistSteam Socialite Provider v1 does not correctly validate openid serverNo score- google chrome, microsoft edge chromium +1 moreInsufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96...6.5 Medium
- google chrome, microsoft edge chromium +1 moreInappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a...6.5 Medium
- ibm planning analyticsIBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused...5.9 Medium
- socket socket.ioInsecure Defaults5.3 Medium
- zte zxhn e8810 firmware, zxhn e8820 firmware, zxhn e8822 firmware +2 moreZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the...7.5 High
- openzaak open zaak, open-zaak +1 moreCORS configuration is possibly vulnerable4.7 Medium
- bitdefender antivirus plusURL Spoofing Vulnerability in Bitdefender SafePay (VA-8958)6.5 Medium
- apereo opencastDisabled Hostname Verification in OpenCast4.8 Medium
- getkirby kirby, panel +1 more.dev domains treated as local in Kirby6.8 Medium
- apple macos, mac os x +1 moreA cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of...6.5 Medium
- mozilla firefoxWhen a link to an external protocol was clicked, a prompt was presented that allowed the user to...6.5 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +3 more +5 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.6 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +3 more +5 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.6 High
- Show moreLoading…