Weakness (CWE)
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Source: MITRE CWE-346
750 results · Feed
-
Medium 4.3
Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to o…
-
High 7.8
Client IPC validation bypass
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
-
Medium 5.5
Privilege Escalation Using PID Reuse in ZCC macOS
The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.
-
Medium 6.7
Untrusted Search Path While Executing REG DELETE by Uninstaller
The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.
-
Medium 6.1
Junos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerability
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to r…
-
Medium 6.1
Junos OS Evolved: PTX10003 Series: MAC address validation bypass vulnerability
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forward…
-
Critical 9.4
Origin Check Bypass
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request. This vulnerability can be triggered by an HTTP endpoint exposed to the…
-
Medium 4.3
Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to …
-
Medium 4.7
Unintentional leakage of private information via cross-origin websocket session hijacking
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.
-
Medium 6.2
WebSockets accept connections from HTTPS origin
Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.
-
Unscored —
A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confus…
-
High 8.8
D-Link DSL-224 firmware version 3.0.10 post authentication command execution
D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.
-
Unscored —
An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticat…
-
Unscored —
This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.…
-
Unscored —CVE-2022-46718 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Vent…
-
Unscored —
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Monterey 12…
-
Critical 9.8CVE-2023-29711 EPSS 70%
An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbit…
-
Medium 5.1
An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) rem…
-
Critical 9.8
In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.
-
Medium 4.1
Rockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure
The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local clien…
-
Medium 5.5
An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service vi…
-
Medium 5.5
An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service …
-
Medium 5.5
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manip…
-
Critical 9.8
Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attack…
-
Medium 5.9
An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starti…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
High 8.8
An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform …
-
High 7.5
Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification f…
-
High 8.8
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted p…
-
High 7.5
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service atta…
-
High 7.1
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service atta…
-
Critical 9.8
The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a sev…
-
High 7.5
Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download…
-
Medium 5.5
Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive …
-
Medium 4.8
Jenkins SAML Single Sign On(SSO) Plugin missing hostname validation
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
-
High 7.5
Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthent…
-
Medium 5.3
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, mac…
-
Medium 5.5
This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16…
-
High 8.6
This issue was addressed with a new entitlement. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macO…