CWE-346 · Origin Validation Error (page 7)
Page 7 of 8 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14519 | High | 7.5 | 2020-09-16 | This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer… |
CVE-2020-15652 | Medium | 6.5 | 2020-08-10 | By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content… |
CVE-2020-16168 | Medium | 6.5 | 2020-08-07 | Origin Validation Error in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to access the REST API and MQTT broker used by t… |
CVE-2020-1449 | High | 7.8 | 2020-07-14 | A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project… |
CVE-2020-1408 | High | 8.8 | 2020-07-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote… |
CVE-2020-15104 | Medium | 4.6 | 2020-07-14 | In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative… |
CVE-2020-14456 | High | 7.3 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-202… |
CVE-2020-12397 | Medium | 4.3 | 2020-05-22 | By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerab… |
CVE-2020-11069 | High | 8.0 | 2020-05-14 | In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-s… |
CVE-2020-11868 | High | 7.5 | 2020-04-17 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoof… |
CVE-2020-8984 | High | 7.5 | 2020-03-24 | lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header. |
CVE-2020-8819 | High | 8.1 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function i… |
CVE-2020-8818 | High | 8.1 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in… |
CVE-2019-4640 | Critical | 9.8 | 2020-02-19 | IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which co… |
CVE-2020-0695 | Medium | 5.4 | 2020-02-11 | A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Serve… |
CVE-2019-16517 | Critical | 9.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin… |
CVE-2020-0647 | Medium | 5.4 | 2020-01-14 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vul… |
CVE-2019-11762 | Medium | 6.1 | 2020-01-08 | If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on… |
CVE-2019-20329 | High | 8.1 | 2020-01-03 | OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000. |
CVE-2019-5062 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By… |
CVE-2019-13740 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-19545 | Medium | 6.3 | 2019-12-05 | Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows res… |
CVE-2019-18381 | Medium | 6.3 | 2019-12-05 | Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows res… |
CVE-2019-19019 | High | 7.5 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arbitrary code as root… |
CVE-2019-5227 | Medium | 5.5 | 2019-11-29 | P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190… |
CVE-2019-5226 | Medium | 5.5 | 2019-11-29 | P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190… |
CVE-2019-13664 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2019-1447 | Medium | 5.4 | 2019-11-12 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spo… |
CVE-2019-1445 | Medium | 5.4 | 2019-11-12 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spo… |
CVE-2019-1442 | Medium | 5.5 | 2019-11-12 | A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which cou… |
CVE-2019-1413 | Medium | 4.3 | 2019-11-12 | A security feature bypass vulnerability exists when Microsoft Edge improperly handles extension requests and fails to request host permission for all_urls, aka… |
CVE-2019-15020 | Critical | 9.8 | 2019-10-09 | A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid software update image to… |
CVE-2019-3980 | Critical | 9.8 | 2019-10-08 | The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on… |
CVE-2019-16275 | Medium | 6.5 | 2019-09-12 | hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mi… |
CVE-2019-8069 | Critical | 9.8 | 2019-09-12 | Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation… |
CVE-2019-1235 | High | 7.8 | 2019-09-11 | An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or com… |
CVE-2019-16237 | High | 7.5 | 2019-09-11 | Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. |
CVE-2019-16235 | High | 7.5 | 2019-09-11 | Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala. |
CVE-2019-11777 | High | 7.5 | 2019-09-11 | In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verific… |
CVE-2019-5036 | High | 7.5 | 2019-08-20 | An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafte… |
CVE-2019-9817 | Medium | 5.3 | 2019-07-23 | Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violati… |
CVE-2019-11723 | High | 7.5 | 2019-07-23 | A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookie… |
CVE-2019-5834 | Medium | 6.5 | 2019-06-27 | Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-8282 | Medium | 5.3 | 2019-06-07 | Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows at… |
CVE-2018-5409 | Critical | 9.8 | 2019-05-08 | The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and… |
CVE-2019-9808 | Medium | 5.3 | 2019-04-26 | If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The not… |
CVE-2019-9803 | High | 7.4 | 2019-04-26 | The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be… |
CVE-2019-9797 | Medium | 5.3 | 2019-04-26 | Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering… |
CVE-2019-9499 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validat… |
CVE-2019-9498 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the… |
CVE-2018-4319 | High | 8.1 | 2019-04-03 | A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 1… |
CVE-2019-9764 | High | 7.4 | 2019-03-26 | HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostnam… |
CVE-2018-18499 | Medium | 6.5 | 2019-02-28 | A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to anothe… |
CVE-2018-18494 | Medium | 6.5 | 2019-02-28 | A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another sit… |
CVE-2018-12402 | Medium | 6.5 | 2019-02-28 | The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Sa… |
CVE-2019-5773 | Medium | 6.5 | 2019-02-19 | Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2019-7399 | High | 7.4 | 2019-02-17 | Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages. |
CVE-2018-20745 | Medium | 5.9 | 2019-01-28 | Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS securit… |
CVE-2018-20744 | Medium | 5.9 | 2019-01-28 | The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompati… |
CVE-2018-16072 | Medium | 6.5 | 2019-01-09 | A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass same origin policy via a cr… |
CVE-2018-15723 | Critical | 9.8 | 2018-12-20 | The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attac… |
CVE-2018-5400 | Critical | 9.1 | 2018-10-08 | The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The origi… |
CVE-2018-6690 | High | 7.1 | 2018-09-18 | Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 an… |
CVE-2018-14903 | High | 7.5 | 2018-08-30 | EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a printer malfunction… |
CVE-2018-3834 | High | 7.4 | 2018-08-02 | An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via… |
CVE-2018-8235 | Medium | 4.3 | 2018-06-14 | A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas… |
CVE-2018-5157 | High | 7.5 | 2018-06-11 | Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to… |
CVE-2018-5116 | Critical | 9.8 | 2018-06-11 | WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions… |
CVE-2018-5109 | Medium | 5.3 | 2018-06-11 | An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the… |
CVE-2017-7808 | Medium | 5.3 | 2018-06-11 | A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. Thi… |
CVE-2017-7797 | High | 7.5 | 2018-06-11 | Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be a… |
CVE-2016-9902 | High | 7.5 | 2018-06-11 | The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content… |
CVE-2018-10591 | Medium | 6.1 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-8112 | Medium | 4.3 | 2018-05-09 | A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas… |
CVE-2017-13274 | Critical | 9.8 | 2018-04-04 | In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with… |
CVE-2018-6764 | High | 7.8 | 2018-02-23 | util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container p… |
CVE-2018-6654 | High | 8.8 | 2018-02-06 | The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-if… |
CVE-2017-18016 | Medium | 5.3 | 2018-01-11 | Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via th… |
CVE-2017-1000455 | Medium | 5.5 | 2018-01-02 | GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store… |
CVE-2017-7561 | High | 7.5 | 2017-09-13 | Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in… |
CVE-2017-0902 | High | 8.1 | 2017-08-31 | RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and ins… |
CVE-2017-8650 | Medium | 5.4 | 2017-08-08 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to exploit a security feature bypass due to Microsoft Edge not properly enforcing same-origin po… |
CVE-2017-8530 | Medium | 5.4 | 2017-06-15 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou… |
CVE-2017-8523 | Medium | 4.3 | 2017-06-15 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou… |
CVE-2017-7667 | High | 7.5 | 2017-06-12 | Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin. |
CVE-2017-5646 | Medium | 6.8 | 2017-05-26 | For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS th… |
CVE-2017-8793 | High | 8.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attack… |
CVE-2017-6519 | Critical | 9.1 | 2017-05-01 | avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote att… |
CVE-2016-5168 | High | 7.5 | 2017-04-21 | Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information. |
CVE-2016-8358 | High | 8.5 | 2017-02-13 | An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. The affected software does not verify the iden… |
CVE-2017-5858 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5606 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5605 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5604 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5603 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5602 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5593 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5592 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5591 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5590 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |