Weakness (CWE)
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Source: MITRE CWE-346
261 results · Clear filters · Feed
-
High 7.8
An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on…
-
High 8.6
There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerabil…
-
High 8.6
Improper Access Control in Dataprom Informatics' PACS-ACSS
Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traffic Injection. This issue affects Personnel Attendance Control Systems (PACS) / Access Control Securi…
-
High 7.5
lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quan…
-
High 8.1
Data Leak through CORS Misconfiguration in parisneo/lollms-webui
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to …
-
High 7.5
Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending …
-
High 7.5
An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.j…
-
High 7.3
Local Privilege Escalation on Zscaler Client Connector on Windows
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.
-
High 7.8
Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerabilit…
-
High 8.1
Data leak through CORS misconfiguration in stitionai/devika
A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actio…
-
High 7.5
GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the defa…
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.4
BIG-IP APM browser network access VPN client vulnerability
An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note: Software versions which have reached End of Technical Support (EoTS) are…
-
High 7.6
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can ta…
-
High 7.1
Keycloak: path traversal in the redirect validation
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It…
-
High 7.4
Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applicati…
-
High 8.4
MeshCentral cross-site websocket hijacking (CSWSH) vulnerability
MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative act…
-
High 8.8
Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing at…
-
High 7.8
A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attack…
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 8.6
@koa/cors has overly permissive origin policy
@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an `Access-Control-Allow-Origin` header with t…
-
High 7.8
Client IPC validation bypass
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
-
High 8.8
D-Link DSL-224 firmware version 3.0.10 post authentication command execution
D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.
-
High 8.8
An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform …
-
High 7.5
Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification f…
-
High 8.8
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted p…
-
High 7.5
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service atta…
-
High 7.1
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service atta…
-
High 7.5
Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download…
-
High 7.5
Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthent…
-
High 8.6
This issue was addressed with a new entitlement. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macO…
-
High 8.3CVE-2023-30856 Public exploit
eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbit…
-
High 8.2
code-server vulnerable to Missing Origin Validation in WebSockets
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.