CWE-346 · Origin Validation Error (page 7)
Page 7 of 8 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23764 | High | 8.8 | 2022-08-17 | The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification l… |
CVE-2022-1497 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a cr… |
CVE-2022-31151 | Low | 3.7 | 2022-07-21 | Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, rem… |
CVE-2022-26137 | High | 8.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application… |
CVE-2022-23763 | High | 7.8 | 2022-06-28 | Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerab… |
CVE-2022-1747 | Medium | 4.6 | 2022-06-24 | The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery… |
CVE-2022-30228 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not apply cross-origin resource sharing (CO… |
CVE-2022-31024 | Medium | 6.5 | 2022-06-02 | richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be… |
CVE-2022-25227 | High | 8.8 | 2022-05-20 | Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user… |
CVE-2022-29818 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed |
CVE-2021-32985 | High | 7.2 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid. |
CVE-2020-24772 | High | 8.8 | 2022-03-21 | In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client a… |
CVE-2022-22594 | Medium | 6.5 | 2022-03-18 | A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3… |
CVE-2022-24762 | Medium | 6.5 | 2022-03-14 | sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have… |
CVE-2022-25146 | Medium | 5.3 | 2022-03-03 | The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event mess… |
CVE-2021-46701 | High | 7.2 | 2022-02-20 | PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interf… |
CVE-2022-0120 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Passwords in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially leak cross-origin data via a maliciou… |
CVE-2022-0113 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-0111 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a crafted HTML page. |
CVE-2022-0108 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-21712 | High | 7.5 | 2022-02-07 | twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-ori… |
CVE-2022-23032 | Medium | 5.3 | 2022-01-25 | In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac… |
CVE-2021-44458 | High | 8.3 | 2022-01-10 | Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from th… |
CVE-2021-45441 | High | 7.8 | 2022-01-10 | A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop and manipulate a specially crafted file to… |
CVE-2020-9060 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, Zo… |
CVE-2021-4024 | Medium | 6.5 | 2021-12-23 | A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` pro… |
CVE-2021-44935 | Critical | 9.1 | 2021-12-14 | glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely wit… |
CVE-2021-39063 | Critical | 9.1 | 2021-12-13 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and… |
CVE-2021-43531 | Medium | 4.3 | 2021-12-08 | When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the… |
CVE-2021-38507 | Medium | 6.5 | 2021-12-08 | The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HT… |
CVE-2021-38497 | Medium | 6.5 | 2021-11-03 | Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusi… |
CVE-2021-41158 | Medium | 5.8 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-37967 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process… |
CVE-2021-37966 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2021-30630 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2021-41088 | High | 8.0 | 2021-09-23 | Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web… |
CVE-2020-27969 | High | 7.3 | 2021-09-13 | Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing |
CVE-2021-39185 | Critical | 9.1 | 2021-09-01 | Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 thr… |
CVE-2021-34435 | High | 8.8 | 2021-09-01 | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it i… |
CVE-2021-39175 | High | 8.1 | 2021-08-30 | HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-no… |
CVE-2021-30596 | Medium | 4.3 | 2021-08-26 | Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2021-39270 | High | 7.5 | 2021-08-18 | In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur. |
CVE-2021-37705 | Critical | 10.0 | 2021-08-13 | OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authe… |
CVE-2021-21229 | Medium | 6.5 | 2021-04-30 | Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2021-21211 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21209 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-31718 | High | 8.8 | 2021-04-25 | The server in npupnp before 4.1.4 is affected by DNS rebinding in the embedded web server (including UPnP SOAP and GENA endpoints), leading to remote code exec… |
CVE-2021-26291 | Critical | 9.1 | 2021-04-23 | Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potenti… |
CVE-2021-28048 | Medium | 6.5 | 2021-04-14 | An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin… |
CVE-2020-15734 | Medium | 5.5 | 2021-04-12 | An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other file… |
CVE-2021-23986 | Medium | 6.5 | 2021-03-31 | A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this c… |
CVE-2021-21184 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21183 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21175 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2021-21164 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-21163 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2021-1231 | Medium | 4.7 | 2021-02-24 | A vulnerability in the Link Layer Discovery Protocol (LLDP) for Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow… |
CVE-2021-27197 | High | 8.1 | 2021-02-12 | DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being… |
CVE-2021-21136 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2021-21135 | Medium | 6.5 | 2021-02-09 | Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2021-20199 | Medium | 5.9 | 2021-02-02 | Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applic… |
CVE-2020-4881 | High | 7.5 | 2021-01-19 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS commun… |
CVE-2020-28481 | Medium | 5.3 | 2021-01-19 | The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. |
CVE-2020-6881 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages… |
CVE-2020-26251 | Medium | 4.7 | 2020-12-18 | Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3… |
CVE-2020-15733 | Medium | 6.5 | 2020-12-14 | An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to misrepresent itself in the URL bar. Th… |
CVE-2020-26234 | Medium | 4.8 | 2020-12-08 | Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname ver… |
CVE-2020-26253 | Medium | 6.8 | 2020-12-08 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may b… |
CVE-2020-3864 | High | 7.8 | 2020-10-27 | A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tv… |
CVE-2019-8754 | Medium | 6.5 | 2020-10-27 | A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in macOS Catalina 10.15… |
CVE-2020-15682 | Medium | 6.5 | 2020-10-22 | When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induc… |
CVE-2020-16952 | High | 8.6 | 2020-10-16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-16951 | High | 8.6 | 2020-10-16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-9903 | High | 7.5 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. A malicious attacker may cause Safari t… |
CVE-2020-26527 | Critical | 9.8 | 2020-10-02 | An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origi… |
CVE-2020-15773 | Medium | 6.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker ca… |
CVE-2020-14519 | High | 7.5 | 2020-09-16 | This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer… |
CVE-2020-15652 | Medium | 6.5 | 2020-08-10 | By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content… |
CVE-2020-16168 | Medium | 6.5 | 2020-08-07 | Origin Validation Error in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to access the REST API and MQTT broker used by t… |
CVE-2020-1449 | High | 7.8 | 2020-07-14 | A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project… |
CVE-2020-1408 | High | 8.8 | 2020-07-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote… |
CVE-2020-15104 | Medium | 4.6 | 2020-07-14 | In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative… |
CVE-2020-14456 | High | 7.3 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-202… |
CVE-2020-12397 | Medium | 4.3 | 2020-05-22 | By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerab… |
CVE-2020-11069 | High | 8.0 | 2020-05-14 | In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-s… |
CVE-2020-11868 | High | 7.5 | 2020-04-17 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoof… |
CVE-2020-8984 | High | 7.5 | 2020-03-24 | lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header. |
CVE-2020-8819 | High | 8.1 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function i… |
CVE-2020-8818 | High | 8.1 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in… |
CVE-2019-4640 | Critical | 9.8 | 2020-02-19 | IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which co… |
CVE-2020-0695 | Medium | 5.4 | 2020-02-11 | A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Serve… |
CVE-2019-16517 | Critical | 9.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin… |
CVE-2020-0647 | Medium | 5.4 | 2020-01-14 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vul… |
CVE-2019-11762 | Medium | 6.1 | 2020-01-08 | If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on… |
CVE-2019-20329 | High | 8.1 | 2020-01-03 | OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000. |
CVE-2019-5062 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By… |
CVE-2019-13740 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-19545 | Medium | 6.3 | 2019-12-05 | Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows res… |
CVE-2019-18381 | Medium | 6.3 | 2019-12-05 | Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows res… |
CVE-2019-19019 | High | 7.5 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arbitrary code as root… |