Weakness (CWE)
CWE-830: Inclusion of Web Functionality from an Untrusted Source
Variant Incomplete
The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
Source: MITRE CWE-830
7 results · Clear filters · Feed
-
Medium 6.1
In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archi…
-
Medium 6.1
An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access…
-
Medium 6.1
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypas…
-
Medium 6.1
In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.…
-
Medium 6.1
In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attacker…
-
Medium 6.1
OMERO.web JSONP callback vulnerability
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version…
-
Medium 6.1
Command Injection in @theia/messages
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.