Weakness (CWE)
CWE-830: Inclusion of Web Functionality from an Untrusted Source
The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
Source: MITRE CWE-830
6 results · Clear filters · Feed
-
High 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker…
-
High 8.5
Minder does not sandbox http.send in Rego programs
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which…
-
High 7.3
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbi…
-
High 8.3
os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows…
-
High 8.4
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript executio…
-
High 8.8
Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ …