CWE-346 · Origin Validation Error (page 9)
Page 9 of 9 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9902 | High | 7.5 | 2018-06-11 | The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content… |
CVE-2018-10591 | Medium | 6.1 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-8112 | Medium | 4.3 | 2018-05-09 | A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas… |
CVE-2017-13274 | Critical | 9.8 | 2018-04-04 | In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with… |
CVE-2018-6764 | High | 7.8 | 2018-02-23 | util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container p… |
CVE-2018-6654 | High | 8.8 | 2018-02-06 | The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-if… |
CVE-2017-18016 | Medium | 5.3 | 2018-01-11 | Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via th… |
CVE-2017-1000455 | Medium | 5.5 | 2018-01-02 | GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store… |
CVE-2017-7561 | High | 7.5 | 2017-09-13 | Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in… |
CVE-2017-0902 | High | 8.1 | 2017-08-31 | RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and ins… |
CVE-2017-8650 | Medium | 5.4 | 2017-08-08 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to exploit a security feature bypass due to Microsoft Edge not properly enforcing same-origin po… |
CVE-2017-8530 | Medium | 5.4 | 2017-06-15 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou… |
CVE-2017-8523 | Medium | 4.3 | 2017-06-15 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou… |
CVE-2017-7667 | High | 7.5 | 2017-06-12 | Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin. |
CVE-2017-5646 | Medium | 6.8 | 2017-05-26 | For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS th… |
CVE-2017-8793 | High | 8.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attack… |
CVE-2017-6519 | Critical | 9.1 | 2017-05-01 | avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote att… |
CVE-2016-5168 | High | 7.5 | 2017-04-21 | Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information. |
CVE-2016-8358 | High | 8.5 | 2017-02-13 | An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. The affected software does not verify the iden… |
CVE-2017-5858 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5606 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5605 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5604 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5603 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5602 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5593 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5592 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5591 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5590 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5589 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2015-4495 | High | 8.8 | 2015-08-08 | The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Po… |
CVE-2014-1502 | | 2014-03-19 | The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attack… | |
CVE-2014-1487 | High | 7.5 | 2014-02-06 | The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote a… |
CVE-2012-4193 | | 2012-10-12 | Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit… | |
CVE-2011-3072 | | 2012-04-05 | Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to pop-up windows. | |
CVE-2011-3067 | | 2012-04-05 | Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to replacement of IFRAME elements. | |
CVE-2011-3056 | | 2012-03-22 | Google Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via vectors involving a "magic iframe." | |
CVE-2011-3956 | | 2012-02-09 | The extension implementation in Google Chrome before 17.0.963.46 does not properly handle sandboxed origins, which might allow remote attackers to bypass the S… | |
CVE-2011-2856 | | 2011-09-19 | Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. | |
CVE-2009-4139 | Medium | 6.8 | 2011-07-27 | A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of… |
CVE-2009-1185 | | 2009-04-17 | udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK mess… | |
CVE-2005-0877 | High | 7.5 | 2005-05-02 | Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq. |
CVE-2003-0981 | Medium | 6.1 | 2004-01-05 | FreeScripts VisitorBook LE (visitorbook.pl) logs the reverse DNS name of a visiting host, which allows remote attackers to spoof the origin of their incoming r… |
CVE-2003-0174 | Critical | 9.8 | 2003-05-12 | The LDAP name service (nsd) in IRIX 6.5.19 and earlier does not properly verify if the USERPASSWORD attribute has been provided by an LDAP server, which could… |
CVE-2001-1452 | High | 7.5 | 2001-08-31 | By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to… |
CVE-2000-1218 | Critical | 9.8 | 2000-04-14 | The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Win… |
CVE-1999-1549 | High | 7.8 | 1999-11-16 | Lynx 2.x does not properly distinguish between internal and external HTML, which may allow a local attacker to read a "secure" hidden form value from a tempora… |