CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a...4.3 Medium
- google chromeInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53...4.3 Medium
- google chromeInappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827...4.3 Medium
- google chromeInappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a...5.4 Medium
- google chromeInsufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a...6.3 Medium
- google chromeInsufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53...4.3 Medium
- google chromeInappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed...6.5 Medium
- google chromeInappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed...6.5 Medium
- google chromeInappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...6.5 Medium
- google chromeInappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- adguard adguardhomeAdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle6.3 Medium
- jupyter server, jupyter/jupyter +1 moreCORS Origin Validation Bypass in jupyter-server6.1 Medium
- aio-libs aiohttpAIOHTTP vulnerable to cross-origin redirect with per-request cookies6.6 Medium
- namelessmc namelessNamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping5.4 Medium
- home assistant companion app (android), companion app (ios), home-assistant core +2 moreHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection8.3 High
- google chromeInappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed...5.0 Medium
- google chromeInappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote...6.3 Medium
- rustfsRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console6.0 Medium
- synology assistantAn origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local...6.1 Medium
- synology active backup for business agentAn origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1...6.1 Medium
- synology activeprotect agentOrigin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows...6.1 Medium
- microsoft entra id, entra +1 moreMicrosoft Entra ID Elevation of Privilege Vulnerability10.0 Critical
- jovancoding network-aiNetwork-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret7.6 High
- trendmicro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 moreAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 moreAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 moreAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 moreAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 moreAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 moreAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one (mac) +1 moreAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one (mac) +1 moreAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service...7.8 High
- trendmicro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 moreAn origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to...7.8 High
- flowiseFlowise - Hardcoded CORS Wildcard in TTS Endpoint6.9 Medium
- nlnet labs unboundAnother 'ghost domain names' attack variant6.6 Medium
- Show moreLoading…