CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- xiaomi quick app frameworkquick App has intent redriction vulnerability4.3 Medium
- xiaomi smarthome applicationXiaomi smarthome application Webview has code execution vulnerability8.8 High
- binary-husky binary-husky/gpt academic, gpt academic +1 moreCross-Site WebSocket Hijacking in binary-husky/gpt_academic7.6 High
- modelscope agentscope, modelscope/agentscope +1 moreCORS Vulnerability in modelscope/agentscope7.4 High
- prefecthq prefecthq/prefectCORS Misconfiguration in prefecthq/prefect7.6 High
- feast-dev feast-dev/feastCORS Vulnerability in feast-dev/feast7.4 High
- corydolphin corydolphin/flask-cors, flask-cors project flask-cors +1 moreInconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors5.3 Medium
- automatic1111 automatic1111/stable-diffusion-webui, stable-diffusion-webui +1 moreCross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui9.6 Critical
- netease-youdao netease-youdao/qanything, youdao qanything +1 moreCORS Misconfiguration in netease-youdao/qanything7.5 High
- danswer-ai danswer-ai/danswerCORS Misconfiguration in danswer-ai/danswer7.4 High
- iroad dash cam x5, dash cam x6 +1 moreIROAD Dash Cam X5/Dash Cam X6 Domain origin validation6.3 Medium
- misskeyMisskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes9.3 Critical
- danielgatis rembgRembg CORS misconfiguration8.7 High
- ubiquiti inc unifi protect camerasAn Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious...6.8 Medium
- q-free maxtimeA CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or...5.5 Medium
esbuildnpm,esbuild-android-64TuxCare,@esbuild/android-armTuxCare +43 more +45 moreesbuild enables any website to send any requests to the development server and read the response5.3 Medium- mindskip xzs-mysql, xzs-mysql 学之思开源考试系统 +1 moreMindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policy2.3 Low
- discourseAnonymous cache poisoning via XHR requests in Discourse8.2 High
- discourseAnonymous cache poisoning via request headers in Discourse8.2 High
- axiosIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining...0.0 None
- oracle communications order and service managementVulnerability in the Oracle Communications Order and Service Management product of Oracle...6.3 Medium
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web...7.5 High
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...5.5 Medium
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...5.4 Medium
- vitejs viteVite allows any websites to send any requests to the development server and read the response6.5 Medium
- siemens sentron 3na com fuse, silabs.com emberznet +1 moreDos in ZigBee device due to unsolicited encrypted rejoin response5.8 Medium
- fortinet fortios, fortiproxy +1 moreAn origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0...4.7 Medium
- mozilla firefox, firefox for ios +1 moreAddress bar spoofing on iOS using long hostnames6.5 Medium
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to...7.8 High
- huawei cv81-wdm fw, cv81-wdm firmware +1 moreThere is an insufficient input verification vulnerability in Huawei product. Successful...8.6 High
- nicmx fort-validatorA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests...5.3 Medium
- apple ipados, macos, safari +5 more +7 moreA cookie management issue was addressed with improved state management. This issue is fixed in...5.3 Medium
- apple macosThis issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2....5.5 Medium
- pnpmpnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion5.8 Medium
- No product listedMSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.4.3 Medium
- No product listedAn issue in Instrument Cluster KIA Seltos Software v1.0, Hardware v1.0 allows attackers to cause...5.3 Medium
- dataprom informatics personnel attendance control systems (pacs) / access control security systems (acss), access control security systems, personnel attendance control systems +1 more +3 moreImproper Access Control in Dataprom Informatics' PACS-ACSS8.6 High
- kalcaddle kodboxAn issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information...5.3 Medium
- pickmall lilishoplilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain...7.5 High
- parisneo lollms-webui, parisneo/lollms-webui, lollms web ui +2 moreData Leak through CORS Misconfiguration in parisneo/lollms-webui8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe origin of an external protocol handler prompt could have been obscured using a data: URL...5.3 Medium
- mirotalk p2pIncorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change...7.5 High
- gradio-app gradioCORS origin validation accepts the null origin in Gradio6.9 Medium
- gradio-app gradioCORS origin validation is not performed when the request has a cookie in Gradio6.9 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA compromised content process could have allowed for the arbitrary loading of cross-origin pages....9.8 Critical
- apple ipados, macos, safari +5 more +7 moreA cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of...6.5 Medium
- google chromeInsufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed...4.3 Medium
- sir gnuboard, gnuboard gnuboard6 +1 moreGnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.8.8 High
- zscaler client connectorLocal Privilege Escalation on Zscaler Client Connector on Windows7.3 High
- Show moreLoading…