CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1,...4.3 Medium
- thm pilosPILOS Misconfigured the Access-Control-Allow-Origin Header6.3 Medium
- strapiStrapi core vulnerable to sensitive data exposure via CORS misconfiguration6.5 Medium
- ibm aspera faspexIBM Aspera Faspex cross-origin resource sharing5.3 Medium
- codecanyon mentor lmsCodeCanyon/ui-lib Mentor LMS API cross-domain policy5.3 Medium
- hiberus sintraCross-origin resource sharing (CORS) in Hiberus Sintra5.1 Medium
- rob--w / cors-anywhere / cors-anywhereRob--W cors-anywhere Misconfigured CORS Proxy Allows SSRF9.5 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Layout component6.5 Medium
- musistudio claude-code-routerclaude-code-router CORS. misconfiguration8.1 High
- ibm concert, concert software +1 moreIBM Concert Software cross-origin resource sharing5.4 Medium
- wago cc100 0751-9x01, edge controller 0752-8303/8000-0002, pfc100 g1 0750-810x/xxxx-xxxx +9 more +11 moreOverly Permissive CORS Policy in WAGO Device Manager6.5 Medium
- ziv idf and zlfCORS vulnerability in IDF and ZLF5.1 Medium
- ziv idf and zlfCORS vulnerability in IDF and ZLF5.3 Medium
- itwanger paicodingitwanger paicoding CrossUtil.java cross-domain policy2.3 Low
- freeebird hotel, hotel 酒店管理系统 api +1 moreFreeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy2.3 Low
- pribai privategptZylon PrivateGPT settings.yaml cross-domain policy5.3 Medium
- omnissa unified access gateway (uag), unified access gateway +1 moreOmnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious...7.1 High
- cyberdigm destinyecmImproper Access Control In DestinyECM7.7 High
- usebruno brunoBruno ignores Safe-Mode in Asserts expressions8.7 High
- arteche satech bcu, satech bcu firmware +1 moreReflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU2.4 Low
- mindskip xzs-mysql, xzs-mysql 学之思开源考试系统 +1 moreMindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policy2.3 Low
- hcltech devops velocity, ibm urbancode velocity +1 moreIBM UrbanCode Velocity cross-origin resource sharing5.3 Medium
- xemle home-galleryGHSL-2024-092: Open CORS policy in home-gallery6.3 Medium
- plexripperPlexRipper allows API leak due to open CORS policy8.7 High
- ibm security reaqta, security qradar edr +1 moreIBM Security ReaQta information disclosure5.3 Medium
- gliffy onlineInsecure Configuration in Gliffy Online6.9 Medium
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1,...8.1 High
- hyperview geoportal toolkitArbitrary cross-domain file inclusion in HyperView Geoportal Toolkit5.3 Medium
- casbin casdoorGHSL-2024-035: Casdoor CORS misconfiguration8.1 High
- usememos memosGHSL-2024-034: memos CORS Misconfiguration in server.go8.1 High
- johnson controls exacqvision, johnsoncontrols exacqvision web service +1 moreexacqVision CORS6.8 Medium
- dell policy manager for secure connect gateway, secure connect gateway (scg) policy manager, secure connect gateway policy manager +2 moreSCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy ...7.5 High
- hcl software dryice lucy, hcltech dryice aex +1 moreHCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability6.5 Medium
- softing edgeaggregator, edgeconnector, secure integration server +2 moreSofting edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability7.5 High
- inductive automation ignitionInductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability7.2 High
- vantage6CORS settings overly permissive in vantage64.2 Medium
- gofiber fiberFiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials9.4 Critical
- westermo lynx, l206-f2g firmware +1 moreWestermo Lynx Permissive Cross-domain Policy with Untrusted Domains6.6 Medium
- ibm powerscIBM PowerSC cross-resource origin sharing5.3 Medium
- microsoft edge chromium, edge (chromium-based) +1 moreMicrosoft Edge for Android Information Disclosure Vulnerability4.3 Medium
- siemens opcenter execution foundation, opcenter quality, simatic pcs neo +8 more +10 moreA vulnerability has been identified in Opcenter Quality (All versions), SIMATIC PCS neo (All...7.1 High
- fortinet fortiadc, fortiddos-f +1 moreA permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 ...5.4 Medium
- siemens simatic pcs neoA vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the...8.0 High
- functional sentrySentry CORS misconfiguration vulnerability6.8 Medium
- acronis cyber infrastructureSensitive information disclosure due to CORS misconfiguration. The following products are...3.1 Low
- media cp control panel, mediacp media control panel +1 moreMedia CP Media Control Panel – Information Disclosure8.1 High
- dell supportassist for home pcs, supportassist client consumer +1 moreDell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain...6.5 Medium
- connectwiseConnectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS).6.1 Medium
- lastyard last yardLast Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).7.5 High
- hcl software onetest serverHCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted4.6 Medium
- Show moreLoading…