Weakness (CWE)
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Source: MITRE CWE-346
749 results · Feed
-
High 8.1
Same-origin policy bypass in the DOM: Navigation component
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Low 2.3
Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to fal…
-
High 7.5
Origin Validation Error Vulnerability in HiRDB
Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Ser…
-
Medium 6.5
rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation
A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument …
-
Medium 6.8
Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 5…
-
Low 3.1
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that th…
-
High 8.2
WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both s…
-
High 8.6
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin heade…
-
Low 2.9
VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare thes…
-
High 8.2
webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the …
-
High 8.6
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insuffici…
-
Medium 5.4
Electron: openExternal permission requests can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one…
-
Medium 5.4
Electron: HID and USB permission checks can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receiv…
-
Medium 5.4
Electron: Pointer lock permission requests can be attributed to the wrong frame
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermission…
-
Low 3.1
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). Supported versions that are…
-
High 8.8
Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social…
-
High 7.4
CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward…
-
Medium 4.3
BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument …
-
High 7.1
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to …
-
Medium 5.9
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
-
Medium 5.4
Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern("*") with setAllowCredentials(true), causing Spring to reflec…
-
High 7.4
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original …
-
High 8.1
AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier m…
-
Medium 5.1
Angular DevTools (Local DoS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages fr…
-
Critical 9.9
Legacy Update ActiveX control accepts unauthorized hosting origins
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's ho…
-
Medium 5.3
.NET Information Disclosure Vulnerability
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
.NET Security Feature Bypass Vulnerability
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 5.9
Azure Key Vault Information Disclosure Vulnerability
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
-
High 8.0
Microsoft Power Apps Remote Code Execution Vulnerability
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
-
Medium 6.5
Azure DevOps Information Disclosure Vulnerability
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
-
Critical 9.1
Same-origin policy bypass in the DevTools component
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
High 8.1
Site isolation issue in the Networking component
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
Medium 5.5
Saved credentials can be autofilled after cross-origin navigation
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox…
-
Critical 9.1
Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When…
-
High 8.8
obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration …
-
Low 3.1
Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non…
-
High 8.1
Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal c…
-
Critical 9.6
Insufficient isolation of user-supplied code in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to ex…
-
Critical 9.1
ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not…
-
Critical 9.1
enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote Repo…