CWE-346 · Origin Validation Error (page 6)
Page 6 of 8 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29868 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized cha… |
CVE-2023-29867 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved… |
CVE-2023-2445 | Medium | 4.9 | 2023-05-02 | Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrie… |
CVE-2023-30856 | High | 8.3 | 2023-04-28 | eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing th… |
CVE-2023-26114 | High | 8.2 | 2023-03-23 | Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow… |
CVE-2023-0957 | High | 8.2 | 2023-03-03 | An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers… |
CVE-2022-45139 | Medium | 5.3 | 2023-02-27 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combina… |
CVE-2021-33959 | High | 7.5 | 2023-01-18 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. |
CVE-2023-0132 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a per… |
CVE-2023-22899 | Medium | 5.9 | 2023-01-10 | Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. |
CVE-2014-125071 | Medium | 5.5 | 2023-01-09 | A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request… |
CVE-2017-20146 | Critical | 9.8 | 2022-12-27 | Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, wh… |
CVE-2022-42927 | High | 8.1 | 2022-12-22 | A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This… |
CVE-2022-38472 | Medium | 6.5 | 2022-12-22 | An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This cou… |
CVE-2022-29915 | Medium | 4.3 | 2022-12-22 | The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100. |
CVE-2022-22757 | Medium | 6.5 | 2022-12-22 | Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to… |
CVE-2022-1520 | Medium | 4.3 | 2022-12-22 | When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encr… |
CVE-2022-41961 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple… |
CVE-2022-41924 | Critical | 9.6 | 2022-11-23 | A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used… |
CVE-2022-3457 | Critical | 9.8 | 2022-10-13 | Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5. |
CVE-2022-41749 | High | 7.8 | 2022-10-10 | An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected installations. Please n… |
CVE-2022-41294 | Medium | 6.5 | 2022-10-06 | IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236… |
CVE-2022-22637 | High | 8.8 | 2022-09-23 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvO… |
CVE-2022-40140 | Medium | 5.5 | 2022-09-19 | An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affecte… |
CVE-2022-23764 | High | 8.8 | 2022-08-17 | The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification l… |
CVE-2022-1497 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a cr… |
CVE-2022-31151 | Low | 3.7 | 2022-07-21 | Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, rem… |
CVE-2022-26137 | High | 8.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application… |
CVE-2022-23763 | High | 7.8 | 2022-06-28 | Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerab… |
CVE-2022-1747 | Medium | 4.6 | 2022-06-24 | The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery… |
CVE-2022-30228 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not apply cross-origin resource sharing (CO… |
CVE-2022-31024 | Medium | 6.5 | 2022-06-02 | richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be… |
CVE-2022-25227 | High | 8.8 | 2022-05-20 | Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user… |
CVE-2022-29818 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed |
CVE-2021-32985 | High | 7.2 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid. |
CVE-2020-24772 | High | 8.8 | 2022-03-21 | In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client a… |
CVE-2022-22594 | Medium | 6.5 | 2022-03-18 | A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3… |
CVE-2022-24762 | Medium | 6.5 | 2022-03-14 | sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have… |
CVE-2022-25146 | Medium | 5.3 | 2022-03-03 | The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event mess… |
CVE-2021-46701 | High | 7.2 | 2022-02-20 | PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interf… |
CVE-2022-0120 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Passwords in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially leak cross-origin data via a maliciou… |
CVE-2022-0113 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-0111 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a crafted HTML page. |
CVE-2022-0108 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-21712 | High | 7.5 | 2022-02-07 | twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-ori… |
CVE-2022-23032 | Medium | 5.3 | 2022-01-25 | In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac… |
CVE-2021-44458 | High | 8.3 | 2022-01-10 | Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from th… |
CVE-2021-45441 | High | 7.8 | 2022-01-10 | A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop and manipulate a specially crafted file to… |
CVE-2020-9060 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, Zo… |
CVE-2021-4024 | Medium | 6.5 | 2021-12-23 | A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` pro… |
CVE-2021-44935 | Critical | 9.1 | 2021-12-14 | glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely wit… |
CVE-2021-39063 | Critical | 9.1 | 2021-12-13 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and… |
CVE-2021-43531 | Medium | 4.3 | 2021-12-08 | When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the… |
CVE-2021-38507 | Medium | 6.5 | 2021-12-08 | The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HT… |
CVE-2021-38497 | Medium | 6.5 | 2021-11-03 | Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusi… |
CVE-2021-41158 | Medium | 5.8 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-37967 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process… |
CVE-2021-37966 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2021-30630 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2021-41088 | High | 8.0 | 2021-09-23 | Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web… |
CVE-2020-27969 | High | 7.3 | 2021-09-13 | Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing |
CVE-2021-39185 | Critical | 9.1 | 2021-09-01 | Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 thr… |
CVE-2021-34435 | High | 8.8 | 2021-09-01 | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it i… |
CVE-2021-39175 | High | 8.1 | 2021-08-30 | HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-no… |
CVE-2021-30596 | Medium | 4.3 | 2021-08-26 | Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2021-39270 | High | 7.5 | 2021-08-18 | In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur. |
CVE-2021-37705 | Critical | 10.0 | 2021-08-13 | OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authe… |
CVE-2021-21229 | Medium | 6.5 | 2021-04-30 | Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2021-21211 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21209 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-31718 | High | 8.8 | 2021-04-25 | The server in npupnp before 4.1.4 is affected by DNS rebinding in the embedded web server (including UPnP SOAP and GENA endpoints), leading to remote code exec… |
CVE-2021-26291 | Critical | 9.1 | 2021-04-23 | Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potenti… |
CVE-2021-28048 | Medium | 6.5 | 2021-04-14 | An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin… |
CVE-2020-15734 | Medium | 5.5 | 2021-04-12 | An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other file… |
CVE-2021-23986 | Medium | 6.5 | 2021-03-31 | A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this c… |
CVE-2021-21184 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21183 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21175 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2021-21164 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-21163 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2021-1231 | Medium | 4.7 | 2021-02-24 | A vulnerability in the Link Layer Discovery Protocol (LLDP) for Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow… |
CVE-2021-27197 | High | 8.1 | 2021-02-12 | DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being… |
CVE-2021-21136 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2021-21135 | Medium | 6.5 | 2021-02-09 | Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2021-20199 | Medium | 5.9 | 2021-02-02 | Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applic… |
CVE-2020-4881 | High | 7.5 | 2021-01-19 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS commun… |
CVE-2020-28481 | Medium | 5.3 | 2021-01-19 | The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. |
CVE-2020-6881 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages… |
CVE-2020-26251 | Medium | 4.7 | 2020-12-18 | Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3… |
CVE-2020-15733 | Medium | 6.5 | 2020-12-14 | An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to misrepresent itself in the URL bar. Th… |
CVE-2020-26234 | Medium | 4.8 | 2020-12-08 | Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname ver… |
CVE-2020-26253 | Medium | 6.8 | 2020-12-08 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may b… |
CVE-2020-3864 | High | 7.8 | 2020-10-27 | A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tv… |
CVE-2019-8754 | Medium | 6.5 | 2020-10-27 | A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in macOS Catalina 10.15… |
CVE-2020-15682 | Medium | 6.5 | 2020-10-22 | When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induc… |
CVE-2020-16952 | High | 8.6 | 2020-10-16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-16951 | High | 8.6 | 2020-10-16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-9903 | High | 7.5 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. A malicious attacker may cause Safari t… |
CVE-2020-26527 | Critical | 9.8 | 2020-10-02 | An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origi… |
CVE-2020-15773 | Medium | 6.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker ca… |