CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- vue.js devtoolsThe Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via...4.3 Medium
- zscaler client connectorClient IPC validation bypass7.8 High
- zscaler client connectorPrivilege Escalation Using PID Reuse in ZCC macOS5.5 Medium
- zscaler client connectorUntrusted Search Path While Executing REG DELETE by Uninstaller6.7 Medium
- juniper junos os evolvedJunos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerability6.1 Medium
- juniper junos os evolvedJunos OS Evolved: PTX10003 Series: MAC address validation bypass vulnerability6.1 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty has Insufficient Bailiwick Validation for NS Records8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records8.7 High
- pos/ dienstleistung, entwicklung & vertrieb gmbh cashit! - serving solutions., cashit cashit\! +1 moreOrigin Check Bypass9.4 Critical
- zohocorp manageengine network configuration managerAn issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The...4.3 Medium
- mozilla firefox, firefox esr, debian linux +2 moreOffscreen Canvas did not properly track cross-origin tainting, which could have been used to...5.3 Medium
- palantir slate, com.palantir.slate:slate +1 moreCVE-2023-309494.3 Medium
- nodebbUnintentional leakage of private information via cross-origin websocket session hijacking4.7 Medium
- mattermost, mattermost server +1 moreWebSockets accept connections from HTTPS origin6.2 Medium
- movimMovim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This...8.0 High
- google androidIn notification access permission dialog box, malicious application can embedded a very long...5.5 Medium
- mozilla firefoxA website could prevent a user from exiting full-screen mode via alert and prompt calls. This...6.5 Medium
- d-link dsl-224 firmware version 3.0.10, dsl-224 firmware +1 moreD-Link DSL-224 firmware version 3.0.10 post authentication command execution8.8 High
- trend micro apex one, trend micro, inc. micro apex one +1 moreAn Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could...5.3 Medium
- apple ipados, macos, tvos +3 more +5 moreThis issue was addressed with improved redaction of sensitive information. This issue is fixed in...5.5 Medium
- apple ipados, macos, iphone os +2 moreA logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and...5.5 Medium
- apple macosThis issue was addressed with improved checks to prevent unauthorized actions. This issue is...5.5 Medium
- interlink psg-5124 firmwareAn incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows...9.8 Critical
- siglent sds 1104x-e firmwareIn Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.9.8 Critical
- nokia asika airscale firmwareAn issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a...5.1 Medium
- rockwell automation factorytalk system services, rockwellautomation factorytalk policy manager +1 moreRockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure4.1 Medium
- urbanandroid twilightAn issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent...5.5 Medium
- ekatox facemoji\An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause...5.5 Medium
- yandex navigatorAn issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a...5.5 Medium
- besder videoplaytoolIncorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool...9.8 Critical
- gitlabAn issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10...5.9 Medium
- southrivertech titan ftp server nextgenAn issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level...8.8 High
- luowiceIncorrect access control in luowice v3.5.18 allows attackers to access cloud source code...7.5 High
- webbax salesboosterPrestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules...7.5 High
- bestweather project bestweatherAn issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent...7.1 High
- bestweather project bestweatherAn issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent...7.5 High
- applika call blockerThe Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related...9.8 Critical
- faronics insightAn issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker...8.8 High
- stormshield endpoint securityStormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated...5.5 Medium
- cbot core, panel, chatbot +2 moreCross-Site WebSocket Hijacking in CBOT's Chatbot4.3 Medium
- jenkins saml single sign on, jenkins project saml single sign on(sso) plugin +1 moreJenkins SAML Single Sign On(SSO) Plugin missing hostname validation4.8 Medium
- seiko solutions inc. skybridge mb-a200, seiko-sol skybridge mb-a200 firmware +1 moreImproper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier...7.5 High
- rocket.chatA vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of...5.3 Medium
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3,...5.5 Medium
- apple macosThis issue was addressed with a new entitlement. This issue is fixed in macOS Ventura 13.3, macOS...8.6 High
- devolutions serverImproper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and...4.9 Medium
- zammadZammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated...6.5 Medium
- zammadZammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker...6.5 Medium
- edex-ui project edex-uieDEX-UI cross-site websocket hijacking vulnerability enables remote command execution8.3 High
- apple ipados, macos, safari +5 more +7 moreThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13...5.5 Medium
- Show moreLoading…