Weakness (CWE)
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Source: MITRE CWE-346
261 results · Clear filters · Feed
-
High 7.5
Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.
-
High 8.1
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redire…
-
High 7.5
Phoenix before 1.6.14 mishandles check_origin wildcarding
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
-
High 8.8
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, wa…
-
High 8.8
TERUTEN WebCube update remote code execution vulnerability
The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.
-
High 7.8
DOUZONE BIZON NeoRS file download and execute vulnerability
Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerability to encourage users to access crafted web pages, causing damage such as malicious code infectio…
-
High 8.8
A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not…
-
High 7.2
AVEVA System Platform Origin Validation Error
AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.
-
High 7.5
Cookie and header exposure in twisted
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLike…
-
High 8.0
Remote code execution via the web UI backend of Elvish
Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check…
-
High 8.8
Remote code execution in Eclipse Theia
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews…
-
High 8.1
XSS vector in slide mode speaker-view
HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or b…
-
High 8.0
Cross-Site Request Forgery in TYPO3 CMS
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an att…
-
High 8.1
Origin Validation Error in Magento 2
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (mer…
-
High 8.1CVE-2020-8819 Public exploit
CardGate Payments plugin for WooCommerce does not validate request origin
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID…
-
High 7.5
Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client…
-
High 7.4
HashiCorp Consul vulnerable to Origin Validation Error
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.
-
High 7.5
Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP
Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.
-
High 8.1
RubyGems has Origin Validation Error vulnerability
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
-
High 7.5
Origin Validation Error in Apache NiFi
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
-
High 8.8
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remot…
KEV May 25, 2022