CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- langflowLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE9.4 Critical
- synology beedrive, beedrive for desktop +1 moreOrigin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3...5.6 Medium
- masacmsHost header poisoning allows account takeover via password reset email8.8 High
- the webkitgtk team webkitgtk, red hat enterprise linux 6, enterprise linux 7 +15 more +17 moreWebkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop7.4 High
- elastic kibanaKibana Origin Validation Error4.3 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80...5.4 Medium
- nagios xiNagios XI < 2024R1.2.2 Host Header Injection8.8 High
- chatwootchatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal fails to verify messages from the cluster network is trusted6.9 Medium
- naver whale browser, navercorp whale +1 moreWhale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual...7.5 High
- kiloview ndiAPI Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products10.0 Critical
- ibm engineering requirements management doors nextIBM Engineering Requirements Management Doors Next spoofing5.7 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor7.0 High
- crowdstrike falcon sensor for windowsCrowdStrike Falcon Sensor for Windows Logic Error6.5 Medium
- sillytavernSillyTavern Web Interface Vulnerable to DNS Rebinding9.7 Critical
- codecanyon mentor lmsCodeCanyon/ui-lib Mentor LMS API cross-domain policy5.3 Medium
- apollographql embeddable-explorerApollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass8.2 High
- cisco aironet access point software (ios xe controller)A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point ...4.3 Medium
- parceljs parcelParcel has an Origin Validation Error vulnerability6.5 Medium
- neo4j neo4j-cypher mcp serverNeo4j Cypher MCP server is vulnerable to DNS rebinding attacks7.4 High
- google chromeInappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0...8.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreCross-Origin Opener Policy Vulnerability in pgAdmin 47.9 High
- akinsoft limondeskHost Header Injection in Akinsoft's LimonDesk7.3 High
- akinsoft octocloudHost Header Injection in Akinsoft's OctoCloud4.7 Medium
- github.com/gorilla/csrfImproper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf7.3 High
- shopizerAn issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client...8.1 High
@elysiajs/corsnpmelysia-cors Origin Validation Error6.5 Medium- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Graphics: Canvas2D component8.1 High
- hcltech bigfix saas, hcl software bigfix saas remediate +1 moreHCL BigFix SaaS Authentication Service is vulnerable to cache poisoning5.3 Medium
- google chromeInappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a...6.5 Medium
- sipwise rtpengineIn Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic...6.9 Medium
- redhat keycloak, red hat build of keycloak 26, build of keycloak 26.0 +1 more +3 moreKeycloak: phishing attack via email verification step in first login flow7.1 High
- naver whale browser, navercorp whale +1 moreWhale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab...7.5 High
- autel maxicharger ac wallbox commercial, maxicharger ac elite business c50 firmware, maxicharger ac pro firmware +7 more +9 moreAutel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability5.0 Medium
- sap se business one integration frameworkSecurity misconfiguration vulnerability in SAP Business One Integration Framework5.3 Medium
- zscaler client connectorMacOS Zscaler Client Connector Local Privilege Escalation7.3 High
- webpack webpack-dev-serverwebpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser6.5 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed through improved state management. This issue is fixed in Safari 18.4,...9.8 Critical
- gradio-app gradiogradio-app gradio CORS is_valid_origin privilege escalation6.3 Medium
- mozilla firefox, thunderbird +1 moreError handling for script execution was incorrectly isolated from web content4.3 Medium
- itwanger paicodingitwanger paicoding CrossUtil.java cross-domain policy2.3 Low
- schweitzer engineering laboratories sel-5037 grid configuratorOrigin Validation Error7.4 High
- freeebird hotel, hotel 酒店管理系统 api +1 moreFreeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy2.3 Low
- pribai privategptZylon PrivateGPT settings.yaml cross-domain policy5.3 Medium
- asus driverhub"This issue is limited to motherboards and does not affect laptops, desktop computers, or other...8.4 High
@misskey-dev/summalynpm@misskey-dev/summaly allows IP Filter Bypass via Redirect5.3 Medium- kitty project kittyopen_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local...4.1 Medium
- imanage work desktop for macCommand Injection in iManage Work Desktop for Mac's Agent Service9.3 Critical
- google chromeInappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a...5.4 Medium
- xiaomi shop applicationxiaomi shop application Webview has code execution vulnerability4.3 Medium
- Show moreLoading…