CWE-942 · Permissive Cross-domain Policy with Untrusted Domains (page 2)
Page 2 of 2 — CVEs classified under CWE-942, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25124 | Critical | 9.4 | 2024-02-21 | Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the appli… |
CVE-2023-45213 | Medium | 6.6 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the de… |
CVE-2023-50940 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive in… |
CVE-2024-21382 | Medium | 4.3 | 2024-01-26 | Microsoft Edge for Android Information Disclosure Vulnerability |
CVE-2023-46281 | High | 7.1 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-25603 | Medium | 5.4 | 2023-11-14 | A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an… |
CVE-2023-46098 | High | 8.0 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an… |
CVE-2023-36829 | Medium | 6.8 | 2023-07-06 | Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the… |
CVE-2023-2360 | High | 7.5 | 2023-04-28 | Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135. |
CVE-2023-23464 | High | 8.1 | 2023-02-15 | Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure. |
CVE-2022-34366 | Medium | 6.5 | 2023-02-10 | Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user cou… |
CVE-2023-23128 | Medium | 6.1 | 2023-02-01 | Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allo… |
CVE-2022-47717 | High | 7.5 | 2023-02-01 | Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS). |
CVE-2022-26969 | Critical | 9.8 | 2022-12-26 | In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. |
CVE-2022-31736 | Critical | 9.8 | 2022-12-22 | A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firef… |
CVE-2021-27786 | Medium | 4.6 | 2022-06-09 | Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifie… |
CVE-2021-34435 | High | 8.8 | 2021-09-01 | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it i… |
CVE-2019-14860 | Medium | 6.5 | 2019-11-08 | It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to c… |