Skip to content
OpenAdvisories

Weakness (CWE)

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

Variant Incomplete

The product uses a web-client protection
mechanism such as a Content Security Policy (CSP) or
cross-domain policy file, but the policy includes untrusted
domains with which the web client is allowed to
communicate.

How to prevent it (3 mitigations)

  1. Architecture and Design, Operation

    Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.

  2. Architecture and Design, Operation

    Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.

  3. Architecture and Design, Operation

    For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.

Source: MITRE CWE-942

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-59726 Public exploit Scanner template

    Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

    Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke…

    ruvnet ruflo