CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- coder code-servercode-server vulnerable to Missing Origin Validation in WebSockets8.2 High
- mozilla firefox, firefox esr, thunderbird +2 moreDragging a URL from a cross-origin iframe that was removed during the drag could have led to user...6.5 Medium
- gitpodAn issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site...8.2 High
- wago 751-9301 firmware, 752-8303\/8000-002 firmware, compact controller cc100 (751-9301) +11 more +13 moreWAGO: Origin validation error through CORS misconfiguration5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreURL being dragged from cross-origin iframe into same tab triggers navigation6.5 Medium
- plex media serverPlex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.7.5 High
- zip4j project zip4jZip4j Origin Validation Error5.9 Medium
- google chromeInappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0...6.5 Medium
- gribbit project gribbitlukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets5.5 Medium
- bigbluebuttonBigBlueButton subject to Ineffective user bans4.3 Medium
- tailscaleTailscale Windows daemon is vulnerable to RCE via CSRF9.6 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking...8.1 High
- phoenixframework phoenixPhoenix before 1.6.14 mishandles check_origin wildcarding7.5 High
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreOrigin Validation Error in ikus060/rdiffweb3.7 Low
- trend micro apex oneAn origin validation error vulnerability in Trend Micro Apex One agents could allow a local...7.8 High
- ibm robotic process automationIBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross...6.5 Medium
- trend micro apex oneAn origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could...5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have abused XSLT error handling to associate attacker-controlled content with...6.5 Medium
- teruten webcubeTERUTEN WebCube update remote code execution vulnerability8.8 High
- nodejs undiciUncleared cookies on cross-host/cross-origin redirect in undici3.7 Low
- atlassian bamboo, bitbucket, crowd +19 more +21 moreA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause...8.8 High
- oracle linux, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreImportant: kernel-rt security and bug fix update6.7 Medium
- douzone neorsDOUZONE BIZON NeoRS file download and execute vulnerability7.8 High
- dominionvoting imagecast x, dominion voting systems imagecast x application, imagecast x firmware +2 moreThe authentication mechanism used by voters to activate a voting session on the tested version of...4.6 Medium
- google chrome, fedoraproject fedora +1 moreIncorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed...4.3 Medium
- siemens sicam gridedge (classic), sicam gridedge essential +1 moreA vulnerability has been identified in SICAM GridEdge Essential ARM (All versions < V2.6.6),...8.6 High
- nextcloud richdocuments, kiteworks security-advisories +1 moreFederated editing allows iframing remote servers by default in richdocuments6.5 Medium
- cybelesoft thinfinity vncThinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can...8.8 High
- mozilla firefoxThe Performance API did not properly hide the fact whether a request cross-origin resource has...4.3 Medium
- mozilla thunderbirdWhen viewing an email message A, which contains an attached message B, where B is encrypted or...4.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed3.9 Low
- google chromeInappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote...6.5 Medium
- aveva system platformAVEVA System Platform Origin Validation Error7.2 High
- clash project clashIn Dreamacro 1.1.0, an attacker could embed a malicious iframe in a website with a crafted URL...8.8 High
- jcubic sysend, sysend.js +1 moreExposure of Sensitive Information to an Unauthorized Actor in sysend.js6.5 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to check origin of event messages5.3 Medium
- premidPreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events...7.2 High
- mozilla firefoxRemote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have...6.5 Medium
- twisted, debian linux, fedoraproject fedora +2 moreCookie and header exposure in twisted7.5 High
- f5 big-ip access policy manager, big-ip access policy manager client +1 moreIn all versions before 7.2.1.4, when proxy settings are configured in the network access resource...5.3 Medium
- apple macos, safari, tvos +3 more +5 moreA logic issue was addressed with improved state management. This issue is fixed in macOS Monterey...8.8 High
- apple ipados, macos, safari +4 more +6 moreA cross-origin issue in the IndexDB API was addressed with improved input validation. This issue...6.5 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Passwords in Google Chrome prior to 97.0.4692.71 allowed a remote...6.5 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote...6.5 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a...6.5 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a...6.5 Medium
- mirantis lensLack of websocket authentication in Lens causes remote code execution when visiting a malicious website8.3 High
- trend micro apex one, trendmicro worry-free business security, worry-free business security services +2 moreA origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a...7.8 High
- aeon labs zw090-a, fibaro fgwpb-111, silicon labs 500 series +4 more +6 moreZ-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not...6.5 Medium
- containers podman, fedoraproject fedora, redhat enterprise linux +2 moreExposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman6.5 Medium
- Show moreLoading…