Skip to content
OpenAdvisories

Weakness (CWE)

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

Variant Incomplete

The product uses a web-client protection
mechanism such as a Content Security Policy (CSP) or
cross-domain policy file, but the policy includes untrusted
domains with which the web client is allowed to
communicate.

How to prevent it (3 mitigations)

  1. Architecture and Design, Operation

    Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.

  2. Architecture and Design, Operation

    Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.

  3. Architecture and Design, Operation

    For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.

Source: MITRE CWE-942

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2026-34200 Public exploit

    Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

    Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious w…

    nhost nhost
  • High 7.4
    CVE-2026-27579 Public exploit

    CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure

    CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An…

    karnop realtime-collaboration-platform
  • High 8.8
    CVE-2026-22812 Public exploit EPSS 17%

    OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

    OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This …

    anomalyco opencode opencode-ai npm