CWE-346 · Origin Validation Error (page 5)
Page 5 of 8 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44187 | Medium | 6.5 | 2024-09-17 | A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 an… |
CVE-2024-7978 | Medium | 4.3 | 2024-08-21 | Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2024-41475 | High | 8.8 | 2024-08-12 | Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration. |
CVE-2024-23458 | High | 7.3 | 2024-08-06 | While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privile… |
CVE-2024-41926 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malici… |
CVE-2024-41143 | High | 7.8 | 2024-07-29 | Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary process may… |
CVE-2024-22062 | Medium | 6.3 | 2024-07-09 | There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by m… |
CVE-2024-5549 | High | 8.1 | 2024-07-09 | A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings contain… |
CVE-2024-36421 | High | 7.5 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-C… |
CVE-2019-25211 | Critical | 9.1 | 2024-06-29 | parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed… |
CVE-2024-6301 | Medium | 5.3 | 2024-06-25 | Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs |
CVE-2024-37661 | Medium | 6.3 | 2024-06-17 | TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the… |
CVE-2024-5905 | Medium | 4.4 | 2024-06-12 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some… |
CVE-2024-36303 | High | 7.8 | 2024-06-10 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-36302 | High | 7.8 | 2024-06-10 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-36472 | Medium | 6.5 | 2024-05-28 | In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g… |
CVE-2024-28883 | High | 7.4 | 2024-05-08 | An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to by… |
CVE-2023-27360 | High | 8.8 | 2024-05-03 | NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-2377 | High | 7.6 | 2024-04-30 | A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry… |
CVE-2024-32764 | Critical | 9.9 | 2024-04-26 | A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users wi… |
CVE-2024-1249 | High | 7.4 | 2024-04-17 | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordina… |
CVE-2024-28224 | Medium | 6.6 | 2024-04-08 | Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat wi… |
CVE-2024-2447 | Medium | 6.5 | 2024-04-05 | Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of pos… |
CVE-2023-5973 | Medium | 4.3 | 2024-04-05 | Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved cha… |
CVE-2021-47157 | Critical | 9.8 | 2024-03-18 | The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling. |
CVE-2024-2182 | Medium | 6.5 | 2024-03-12 | A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject special… |
CVE-2024-25996 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. |
CVE-2023-30996 | Medium | 5.3 | 2024-02-26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects o… |
CVE-2024-25124 | Critical | 9.4 | 2024-02-21 | Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the appli… |
CVE-2024-26135 | High | 8.3 | 2024-02-20 | MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx end… |
CVE-2024-0009 | Medium | 6.3 | 2024-02-14 | An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credenti… |
CVE-2024-24782 | Medium | 4.3 | 2024-02-13 | An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated… |
CVE-2024-24557 | Medium | 6.9 | 2024-02-01 | Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image… |
CVE-2023-40547 | High | 8.3 | 2024-01-25 | A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allow… |
CVE-2024-23898 | High | 8.8 | 2024-01-24 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI… |
CVE-2024-0814 | Medium | 6.5 | 2024-01-24 | Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (… |
CVE-2023-47200 | High | 7.8 | 2024-01-23 | A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected in… |
CVE-2023-47199 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47198 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47197 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47196 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47195 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47194 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47193 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-0749 | Medium | 4.3 | 2024-01-23 | A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firef… |
CVE-2023-20275 | Medium | 4.1 | 2023-12-12 | A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could a… |
CVE-2023-49805 | Medium | 6.0 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify tha… |
CVE-2023-49803 | High | 8.6 | 2023-12-11 | @koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that… |
CVE-2023-28794 | Medium | 4.3 | 2023-11-06 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: befor… |
CVE-2023-5859 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local H… |
CVE-2023-5858 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML… |
CVE-2023-5853 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromi… |
CVE-2023-5851 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page… |
CVE-2023-5718 | Medium | 4.3 | 2023-10-23 | The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web… |
CVE-2023-28795 | High | 7.8 | 2023-10-23 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Conn… |
CVE-2021-26737 | Medium | 5.5 | 2023-10-23 | The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to s… |
CVE-2021-26735 | Medium | 6.7 | 2023-10-23 | The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to ex… |
CVE-2023-44190 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows… |
CVE-2023-44189 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to byp… |
CVE-2023-3654 | Critical | 9.4 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the ho… |
CVE-2023-2848 | High | 8.0 | 2023-09-14 | Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation. |
CVE-2023-29505 | Medium | 4.3 | 2023-08-04 | An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking. |
CVE-2023-4045 | Medium | 5.3 | 2023-08-01 | Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin po… |
CVE-2022-4917 | Medium | 4.3 | 2023-07-29 | Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via… |
CVE-2023-30949 | Medium | 4.3 | 2023-07-26 | A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. |
CVE-2023-2850 | Medium | 4.7 | 2023-07-25 | NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows… |
CVE-2023-3581 | Medium | 6.2 | 2023-07-17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs. |
CVE-2023-21260 | Medium | 5.5 | 2023-07-13 | In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly… |
CVE-2023-37210 | Medium | 6.5 | 2023-07-05 | A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This… |
CVE-2023-32223 | High | 8.8 | 2023-06-28 | D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method. |
CVE-2023-32553 | Medium | 5.3 | 2023-06-26 | An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to d… |
CVE-2023-28191 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11… |
CVE-2022-46718 | Medium | 5.5 | 2023-06-23 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Mo… |
CVE-2022-42860 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1, macOS Ventur… |
CVE-2023-29711 | Critical | 9.8 | 2023-06-22 | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. |
CVE-2023-25188 | Medium | 5.1 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia… |
CVE-2023-25366 | Critical | 9.8 | 2023-06-16 | In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password. |
CVE-2023-2639 | Medium | 4.1 | 2023-06-13 | The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant device… |
CVE-2023-29753 | Medium | 5.5 | 2023-06-09 | An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-29751 | Medium | 5.5 | 2023-06-09 | An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference fil… |
CVE-2023-29756 | Medium | 5.5 | 2023-06-09 | An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files. |
CVE-2023-33443 | Critical | 9.8 | 2023-06-08 | Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative… |
CVE-2023-2589 | Medium | 5.9 | 2023-06-07 | An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versio… |
CVE-2023-28164 | Medium | 6.5 | 2023-06-02 | Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability af… |
CVE-2023-23601 | Medium | 6.5 | 2023-06-02 | Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability… |
CVE-2023-27745 | High | 8.8 | 2023-06-02 | An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending reques… |
CVE-2023-29745 | High | 7.1 | 2023-05-31 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database. |
CVE-2023-28349 | High | 8.8 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the T… |
CVE-2023-29743 | High | 7.5 | 2023-05-30 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database. |
CVE-2023-29728 | Critical | 9.8 | 2023-05-30 | The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack. |
CVE-2023-33740 | High | 7.5 | 2023-05-30 | Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning mess… |
CVE-2023-23561 | Medium | 5.5 | 2023-05-30 | Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information. |
CVE-2023-30196 | High | 7.5 | 2023-05-30 | Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php. |
CVE-2023-2886 | Medium | 4.3 | 2023-05-25 | Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: be… |
CVE-2023-32993 | Medium | 4.8 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve… |
CVE-2023-23578 | High | 7.5 | 2023-05-10 | Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the produc… |
CVE-2023-28318 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server conf… |
CVE-2023-27962 | Medium | 5.5 | 2023-05-08 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to… |
CVE-2023-27944 | High | 8.6 | 2023-05-08 | This issue was addressed with a new entitlement. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to… |
CVE-2023-27932 | Medium | 5.5 | 2023-05-08 | This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9… |