CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- sonicwall sonicos A permissive cross-domain policy vulnerability has been identified in the SonicOS management... 8.8 High
- gojue moling MoLing: unauthenticated SSE and wildcard CORS expose tool sessions 9.6 Critical
- gofiber fiber Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads 5.9 Medium
- flarum framework, nextcloud flow, vaadin +2 more Push Endpoint Returns Permissive CORS Headers 2.3 Low
- transmission Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token 8.7 High
- vllm vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server 3.4 Low
- google agent development kit (adk) for java Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server 7.2 High
- ibm concert IBM Concert Software Permissive Cross-domain Security Policy 3.7 Low
- apache camel Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set 4.3 Medium
- apache camel Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection 6.5 Medium
- huangruiteng loopx LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files 7.1 High
- erudika scoold Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain 5.4 Medium
- go-vikunja vikunja Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins 7.2 High
- hkuds vibe-trading HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE 9.3 Critical
- hcl icontrol iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability,... 4.3 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: CORS * reflects Origin with Allow-Credentials 7.6 High
- eclipse foundation open-vsx.org Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data 8.7 High
- hcl software bigfix service management HCL BigFix Service Management is affected by multiple security vulnerabilities. 3.1 Low
- red hat build of apache camel 3.33.4.redhat, build of apache camel 4 for quarkus 3, build of apicurio registry 3 +18 more +20 more Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config 7.4 High
- ag-ui-protocol ag-ui ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy 2.3 Low
- apache software foundation storm webapp Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins 8.1 High
- microsoft azure arc sql server extension, azure arc sql server extension +1 more Azure Arc SQL Server Extension Elevation of Privilege Vulnerability 8.8 High
- asus armoury crate A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote... 5.3 Medium
- microsoft winml-cli Windows ML CLI: CORS misconfig enables localhost RCE 8.6 High
- heyform HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials 8.1 High
- rybbit-io rybbit Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials 8.6 High
- No product listed Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with... 9.8 Critical
- nicolargo glances Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard 6.5 Medium
- openyak OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution 9.6 Critical
- electron Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads 7.4 High
- andritz 250 scala, hipase-250 +1 more Missing authentication and permissive CORS policy 7.5 High
- janhq jan Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding 5.3 Medium
- progress moveit transfer Improper CORS handling in MOVEit Transfer 7.5 High
- hcl software devops loop CORS Misconfiguration in DevOps Loop 4.2 Medium
- hcl software aftermarket epc HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin... 4.2 Medium
- getgrav grav-plugin-api Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses 8.2 High
- getgrav grav Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin 7.1 High
- voxel51 fiftyone FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data 6.3 Medium
- hkuds lightrag LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests 9.3 Critical
- asus gamesdk Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote... 7.2 High
- mockoon Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft 8.8 High
- ruvnet ruflo Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment 10.0 Critical
- hclsoftware hcl devops deploy HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains 5.4 Medium
- bishopfox joro Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE 9.6 Critical
- ubiquiti inc cloud gateways, cloud keys, dream machines +38 more +40 more A malicious actor who lures an authenticated user to a malicious page could exploit a Cross... 7.5 High
- ibm devops deploy, ucd - ibm devops deploy +1 more IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains 5.4 Medium
- papermark Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint 2.3 Low
- nrwl nx Nx: `nx graph` dev server permissive CORS policy 5.9 Medium
- nicolargo glances Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) 7.4 High
- mervinpraison praisonai PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint 8.6 High
- Show olderLoading…