Skip to content
OpenAdvisories

Weakness (CWE)

CWE-360: Trust of System Event Data

Base Incomplete

Security based on event locations are insecure and can be spoofed.

More detail

Events are a messaging system that may provide control data to programs listening for events. Events often do not have any type of authentication framework to allow them to be verified from a trusted source. Any application, in Windows, on a given desktop can send a message to any window on the same desktop. There is no authentication framework for these messages. Therefore, any message can be used to manipulate any process on the desktop if the process does not check the validity and safeness of those messages.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Never trust or rely on any of the information in an Event for security.

Source: MITRE CWE-360

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.1
    CVE-2024-3371

    Insufficient validation of external input in Compass may enable MITM attacks

    MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass vers…

    MongoDB MongoDB Compass
  • Unscored —
    CVE-2017-0911

    Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" com…

    Twitter Twitter Kit for iOS iOS