CWE-346 · Origin Validation Error (page 6)
Page 6 of 8 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47157 | Critical | 9.8 | 2024-03-18 | The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling. |
CVE-2024-2182 | Medium | 6.5 | 2024-03-12 | A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject special… |
CVE-2024-25996 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. |
CVE-2023-30996 | Medium | 5.3 | 2024-02-26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects o… |
CVE-2024-25124 | Critical | 9.4 | 2024-02-21 | Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the appli… |
CVE-2024-26135 | High | 8.3 | 2024-02-20 | MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx end… |
CVE-2024-0009 | Medium | 6.3 | 2024-02-14 | An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credenti… |
CVE-2024-24782 | Medium | 4.3 | 2024-02-13 | An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated… |
CVE-2024-24557 | Medium | 6.9 | 2024-02-01 | Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image… |
CVE-2023-40547 | High | 8.3 | 2024-01-25 | A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allow… |
CVE-2024-23898 | High | 8.8 | 2024-01-24 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI… |
CVE-2024-0814 | Medium | 6.5 | 2024-01-24 | Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (… |
CVE-2023-47200 | High | 7.8 | 2024-01-23 | A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected in… |
CVE-2023-47199 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47198 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47197 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47196 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47195 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47194 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47193 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-0749 | Medium | 4.3 | 2024-01-23 | A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firef… |
CVE-2023-20275 | Medium | 4.1 | 2023-12-12 | A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could a… |
CVE-2023-49805 | Medium | 6.0 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify tha… |
CVE-2023-49803 | High | 8.6 | 2023-12-11 | @koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that… |
CVE-2023-28794 | Medium | 4.3 | 2023-11-06 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: befor… |
CVE-2023-5859 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local H… |
CVE-2023-5858 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML… |
CVE-2023-5853 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromi… |
CVE-2023-5851 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page… |
CVE-2023-5718 | Medium | 4.3 | 2023-10-23 | The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web… |
CVE-2023-28795 | High | 7.8 | 2023-10-23 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Conn… |
CVE-2021-26737 | Medium | 5.5 | 2023-10-23 | The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to s… |
CVE-2021-26735 | Medium | 6.7 | 2023-10-23 | The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to ex… |
CVE-2023-44190 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows… |
CVE-2023-44189 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to byp… |
CVE-2023-3654 | Critical | 9.4 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the ho… |
CVE-2023-2848 | High | 8.0 | 2023-09-14 | Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation. |
CVE-2023-29505 | Medium | 4.3 | 2023-08-04 | An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking. |
CVE-2023-4045 | Medium | 5.3 | 2023-08-01 | Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin po… |
CVE-2022-4917 | Medium | 4.3 | 2023-07-29 | Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via… |
CVE-2023-30949 | Medium | 4.3 | 2023-07-26 | A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. |
CVE-2023-2850 | Medium | 4.7 | 2023-07-25 | NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows… |
CVE-2023-3581 | Medium | 6.2 | 2023-07-17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs. |
CVE-2023-21260 | Medium | 5.5 | 2023-07-13 | In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly… |
CVE-2023-37210 | Medium | 6.5 | 2023-07-05 | A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This… |
CVE-2023-32223 | High | 8.8 | 2023-06-28 | D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method. |
CVE-2023-32553 | Medium | 5.3 | 2023-06-26 | An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to d… |
CVE-2023-28191 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11… |
CVE-2022-46718 | Medium | 5.5 | 2023-06-23 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Mo… |
CVE-2022-42860 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1, macOS Ventur… |
CVE-2023-29711 | Critical | 9.8 | 2023-06-22 | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. |
CVE-2023-25188 | Medium | 5.1 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia… |
CVE-2023-25366 | Critical | 9.8 | 2023-06-16 | In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password. |
CVE-2023-2639 | Medium | 4.1 | 2023-06-13 | The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant device… |
CVE-2023-29753 | Medium | 5.5 | 2023-06-09 | An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-29751 | Medium | 5.5 | 2023-06-09 | An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference fil… |
CVE-2023-29756 | Medium | 5.5 | 2023-06-09 | An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files. |
CVE-2023-33443 | Critical | 9.8 | 2023-06-08 | Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative… |
CVE-2023-2589 | Medium | 5.9 | 2023-06-07 | An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versio… |
CVE-2023-28164 | Medium | 6.5 | 2023-06-02 | Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability af… |
CVE-2023-23601 | Medium | 6.5 | 2023-06-02 | Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability… |
CVE-2023-27745 | High | 8.8 | 2023-06-02 | An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending reques… |
CVE-2023-29745 | High | 7.1 | 2023-05-31 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database. |
CVE-2023-28349 | High | 8.8 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the T… |
CVE-2023-29743 | High | 7.5 | 2023-05-30 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database. |
CVE-2023-29728 | Critical | 9.8 | 2023-05-30 | The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack. |
CVE-2023-33740 | High | 7.5 | 2023-05-30 | Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning mess… |
CVE-2023-23561 | Medium | 5.5 | 2023-05-30 | Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information. |
CVE-2023-30196 | High | 7.5 | 2023-05-30 | Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php. |
CVE-2023-2886 | Medium | 4.3 | 2023-05-25 | Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: be… |
CVE-2023-32993 | Medium | 4.8 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve… |
CVE-2023-23578 | High | 7.5 | 2023-05-10 | Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the produc… |
CVE-2023-28318 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server conf… |
CVE-2023-27962 | Medium | 5.5 | 2023-05-08 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to… |
CVE-2023-27944 | High | 8.6 | 2023-05-08 | This issue was addressed with a new entitlement. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to… |
CVE-2023-27932 | Medium | 5.5 | 2023-05-08 | This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9… |
CVE-2023-29868 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized cha… |
CVE-2023-29867 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved… |
CVE-2023-2445 | Medium | 4.9 | 2023-05-02 | Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrie… |
CVE-2023-30856 | High | 8.3 | 2023-04-28 | eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing th… |
CVE-2023-26114 | High | 8.2 | 2023-03-23 | Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow… |
CVE-2023-0957 | High | 8.2 | 2023-03-03 | An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers… |
CVE-2022-45139 | Medium | 5.3 | 2023-02-27 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combina… |
CVE-2021-33959 | High | 7.5 | 2023-01-18 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. |
CVE-2023-0132 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a per… |
CVE-2023-22899 | Medium | 5.9 | 2023-01-10 | Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. |
CVE-2014-125071 | Medium | 5.5 | 2023-01-09 | A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request… |
CVE-2017-20146 | Critical | 9.8 | 2022-12-27 | Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, wh… |
CVE-2022-42927 | High | 8.1 | 2022-12-22 | A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This… |
CVE-2022-38472 | Medium | 6.5 | 2022-12-22 | An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This cou… |
CVE-2022-29915 | Medium | 4.3 | 2022-12-22 | The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100. |
CVE-2022-22757 | Medium | 6.5 | 2022-12-22 | Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to… |
CVE-2022-1520 | Medium | 4.3 | 2022-12-22 | When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encr… |
CVE-2022-41961 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple… |
CVE-2022-41924 | Critical | 9.6 | 2022-11-23 | A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used… |
CVE-2022-3457 | Critical | 9.8 | 2022-10-13 | Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5. |
CVE-2022-41749 | High | 7.8 | 2022-10-10 | An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected installations. Please n… |
CVE-2022-41294 | Medium | 6.5 | 2022-10-06 | IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236… |
CVE-2022-22637 | High | 8.8 | 2022-09-23 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvO… |
CVE-2022-40140 | Medium | 5.5 | 2022-09-19 | An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affecte… |