CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- mattermost, mattermost server +1 moreMalicious remote can claim that a user was synced from another remote2.7 Low
- sky co.,ltd. skysea client viewOrigin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e...7.8 High
- zte zxcloud iraiPermissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI6.3 Medium
- stitionai devika, stitionai/devika +1 moreData leak through CORS misconfiguration in stitionai/devika8.1 High
- flowiseai flowiseGHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts7.5 High
- gin-contrib corsGin mishandles a wildcard at the end of an origin string9.1 Critical
- conduitOrigin Validation Error in Conduit5.3 Medium
- tp-link tl-7dr5130, tl-7dr5130 firmware +1 moreTP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks. An attacker in...6.3 Medium
- palo alto networks cortex xdr agentCortex XDR Agent: Local Windows User Can Disrupt Functionality of the Agent2.0 Low
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +1 more +3 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
gnome-shellAlmaLinux,gnome-classic-sessionAlmaLinux,gnome-shell-debuginfoRed Hat +25 more +27 moreModerate: gnome-shell security update6.5 Medium- f5 big-ip, apm clients, big-ip edge client +2 more +4 moreBIG-IP APM browser network access VPN client vulnerability7.4 High
- netgear rax30, rax30 firmware +1 moreNETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability7.5 High
- hitachi energy sdm600A vulnerability exists in the too permissive HTTP response header web server settings of the...7.6 High
- qnap myqnapcloud linkmyQNAPcloud Link9.9 Critical
- red hat build of keycloak 22Keycloak: path traversal in the redirect validation7.1 High
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +20 more +22 moreKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos7.4 High
- ollamaOllama DNS rebinding vulnerability6.6 Medium
- mattermost, mattermost server +1 moreMattermost fails to authenticate the source of certain types of post actions6.5 Medium
- brocade fabric os, broadcom fabric operating system +1 moreTruncated port name4.3 Medium
- kossyThe Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.9.8 Critical
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +9 more +11 morePHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series5.3 Medium
- red hat fast datapath for red hat enterprise linux 8, fast datapath for red hat enterprise linux 9, fast datapath for rhel 10 +5 more +7 moreOvn: insufficient validation of bfd packets may lead to denial of service6.5 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics cross-origin resource sharing5.3 Medium
- gofiber fiberFiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials9.4 Critical
- meshcentralMeshCentral cross-site websocket hijacking (CSWSH) vulnerability8.4 High
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Improper IP Address Verification in GlobalProtect Gateway6.3 Medium
- hima f-com 01, f-com 01 coated, f-com 01 firmware +24 more +26 moreHIMA: Origin Validation Error in multiple products4.3 Medium
- mobyMoby classic builder cache poisoning6.9 Medium
- jenkinsCross-site WebSocket hijacking vulnerability in the Jenkins CLI8.8 High
- google chrome, fedoraproject fedora +1 moreIncorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote...6.5 Medium
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- mozilla firefox, thunderbird, debian linux +1 more +3 moreA phishing site could have repurposed an `about:` dialog to show phishing content with an...4.3 Medium
- redhat shim, red hat enterprise linux 7, enterprise linux 8 +12 more +14 moreShim: rce in http boot support may lead to secure boot bypass8.3 High
- cisco adaptive security appliance (asa) software, adaptive security appliance software, firepower threat defense software +1 more +3 moreA vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA)...4.1 Medium
- uptime.kuma uptime kuma, dockge.kuma dockge, louislam uptime-kuma +2 moreUptime Kuma Missing Origin Validation in WebSockets6.0 Medium
- koajs cors, cross-origin resource sharing for koa +1 more@koa/cors has overly permissive origin policy8.6 High
- zscaler client connectorPAC Files Exposed to Internet Websites4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a...4.3 Medium
- Show moreLoading…