CWE-940: Improper Verification of Source of a Communication Channel
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
A kind of CWE-923 Improper Restriction of Communication Channel to Intended Endpoints.
From the CWE List. © The MITRE Corporation.
Newest
- vsftpd vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking 9.1 Critical
- silicon labs z-wave sdk Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes 5.3 Medium
- silicon labs connect sdk Dis-connect vulnerability in Connect Stack 7.2 High
- aws amazon sagemaker python sdk Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() 9.4 Critical
- ondata ckan-mcp-server CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) 3.1 Low
- aws freertos-plus-tcp Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver 8.2 High
- aws freertos-plus-tcp Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling 9.2 Critical
- angular, angular devtools +1 more Angular DevTools (Local DoS) 5.1 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows Hyper-V Security Feature Bypass Vulnerability 7.4 High
- codepeople sell downloads WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability 6.5 Medium
- zabbix Active agent heartbeat missing TLS check 6.9 Medium
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Remote Code Execution 7.2 High
- apache software foundation plc4x Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them 8.5 High
- yamap inc. -social trekking gps app The Android application "YAMAP -Social Trekking GPS App" contains an improper access control... 5.1 Medium
- howyar weenygenius Howyar｜WeenyGenius - Origin Validation Error 8.7 High
- canva The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged... 9.6 Critical
- le-yan medical practice management system Le-yan｜Medical Practice Management System - Remote Code Execution 8.6 High
- @auth core, nextauthjs next-auth +1 more NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them 6.8 Medium
- tinacms @tinacms/app, tinacms +1 more TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover 7.6 High
- civilian board of contract appeals electronic docketing system (eds), government accountability office electronic protest docketing system (epds) +1 more U.S. GAO EPDS and CBCA EDS network access control bypass 5.1 Medium
- traccar traccar-client Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry 9.3 Critical
- hapijs wreck @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects 6.5 Medium
- netty, red hat build of apache camel - hawtio 4 +1 more Netty's Default QUIC token handler accepts any client-supplied token 7.5 High
- home assistant companion app (android), companion app (ios), home-assistant core +2 more Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection 8.3 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Improper Origin Validation in mlflow/mlflow 9.6 Critical
- steipete summarize Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events 4.6 Medium
- electerm electerm: Local code through electerm's single-instance socket 9.3 Critical
- wwbn avideo WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address 5.3 Medium
- facebook whatsapp for android, whatsapp for ios, whatsapp +2 more Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25... 4.3 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 more undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse 7.5 High
- anviz crosschex standard Anviz CrossChex Standard Improper Verification of Source of a Communication Channel 8.1 High
- gematik authenticator, app-authenticator +1 more Authenticator Vulnerable to Authentication Flow Hijack 9.3 Critical
- openclaw OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface 8.6 High
- echatserver easy chat, easy chat server +1 more Easy Chat Server 3.1 Denial of Service via message Parameter 8.7 High
- automattic mongoose Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source 6.3 Medium
- dell powerprotect data manager Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of... 4.7 Medium
- fortinet fortios, siemens ruggedcom ape1808 +1 more An Improper Verification of Source of a Communication Channel vulnerability [CWE-940]... 3.8 Low
- siemens sidoor atd430w, sidoor ate530g coated, sidoor ate530s coated +142 more +144 more Affected products do not properly enforce TCP sequence number validation in specific scenarios... 8.7 High
- kerlink keros Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly... 5.3 Medium
- openvpn Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.7_rc1 allows an... 4.6 Medium
- motex lanscope endpoint manager, motex inc. lanscope endpoint manager (on-premises) (client program (mr) and detection agent (da)) +1 more Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly... 9.3 Critical
- apple ipados, ios and ipados, iphone os +2 more The issue was resolved by not loading remote images This issue is fixed in iOS 18.6 and iPadOS 18... 4.7 Medium
- sillytavern SillyTavern Web Interface Vulnerable to DNS Rebinding 9.7 Critical
- cisco aironet access point software (ios xe controller) A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point... 4.3 Medium
- arcinfo pcvue Improper validation of payload elements 7.6 High
- sap se netweaver application server java Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java 3.5 Low
- amd versal adaptive soc devices, alveo v80 compute accelerator, platform loader and manager (plm) +6 more +8 more In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post... 3.2 Low
- home-assistant core SSL validation for outgoing requests in Home Assistant Core and used libs not correct 7.0 High
- deepin dde-api-proxy An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can... 8.4 High
- siemens sentron 3na com fuse, silabs.com emberznet +1 more Dos in ZigBee device due to unsolicited encrypted rejoin response 5.8 Medium
- Show olderLoading…