CWE-830: Inclusion of Web Functionality from an Untrusted Source
The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a... 7.5 High
- mindersec minder Minder does not sandbox http.send in Rego programs 8.5 High
- openwebui open webui, open-webui +1 more Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events 7.3 High
- izarc In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an... 6.1 Medium
- ankitects anki An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in... 6.1 Medium
- winzip In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete... 6.1 Medium
- bandisoft bandizip In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This... 6.1 Medium
- peazip In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability... 6.1 Medium
- homebrew brew os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted... 8.3 High
- ome omero-web OMERO.web JSONP callback vulnerability 6.1 Medium
- mozilla firefox, firefox esr, debian linux +2 more An attacker was able to inject an event handler into a privileged object that would allow... 8.4 High
- teltonika remote management system Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to... 8.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 more Command Injection in @theia/messages 6.1 Medium