Weakness (CWE)
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Source: MITRE CWE-346
750 results · Feed
-
Low 2.7
Malicious remote can claim that a user was synced from another remote
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was syn…
-
High 7.8
Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerabilit…
-
Medium 6.3
Permissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI
There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration.
-
High 8.1
Data leak through CORS misconfiguration in stitionai/devika
A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actio…
-
High 7.5
GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the defa…
-
Critical 9.1
Gin mishandles a wildcard at the end of an origin string
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.examp…
-
Medium 5.3
Origin Validation Error in Conduit
Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs
-
Low 2.0
Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the Agent
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some functionality of the agent. However, they are not able to disrupt Cortex XDR agent protection mechan…
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
Medium 6.5
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network…
-
High 7.4
BIG-IP APM browser network access VPN client vulnerability
An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note: Software versions which have reached End of Technical Support (EoTS) are…
-
High 7.6
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can ta…
-
Critical 9.9
myQNAPcloud Link
A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability …
-
High 7.1
Keycloak: path traversal in the redirect validation
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It…
-
High 7.4
Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applicati…
-
Medium 6.6
Ollama DNS rebinding vulnerability
Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).
-
Medium 4.3
Truncated port name
Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports …
-
Critical 9.8
The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.
-
Medium 6.5
Ovn: insufficient validation of bfd packets may lead to denial of service
A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from inside unprivileged workloads, including virtual machines or containers,…
-
Medium 5.3
PHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series
An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user.
-
Medium 5.3
IBM Cognos Analytics cross-origin resource sharing
IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects of different origins. IBM X-Force ID: 254290.
-
Critical 9.4
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-…
-
High 8.4
MeshCentral cross-site websocket hijacking (CSWSH) vulnerability
MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative act…
-
Medium 4.3
HIMA: Origin Validation Error in multiple products
An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.
-
Medium 6.9
Moby classic builder cache poisoning
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONB…
-
High 8.8
Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing at…
-
Medium 6.5
Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoo…
-
High 7.8
A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attack…
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
Medium 4.3
A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the addre…
-
Medium 4.1
A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepow…
-
High 8.6
@koa/cors has overly permissive origin policy
@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an `Access-Control-Allow-Origin` header with t…
-
Medium 4.3
PAC Files Exposed to Internet Websites
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.