CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
variantThe product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (171)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-114108US | critical9.8OT erhöht | — | ||
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth(… | ||||
| CVE-2026-15966US | critical9.8 | — | ||
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before… | ||||
| CVE-2025-27909US | critical9.8 | — | ||
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being lim… | ||||
| CVE-2024-37131US | critical9.8 | — | ||
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this… | ||||
| CVE-2024-25124US | critical9.8 | — | ||
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CO… | ||||
| CVE-2023-50940US | critical9.8 | — | ||
IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the doma… | ||||
| CVE-2022-26969US | critical9.8 | — | ||
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. | ||||
| CVE-2022-31736US | critical9.8 | — | ||
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox… | ||||
| CVE-2021-27786US | critical9.8 | — | ||
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is… | ||||
| CVE-2026-30924US | critical9.6 | — | ||
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Contro… | ||||
| CVE-2026-74881US | critical9.3OT erhöht | — | ||
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make aut… | ||||
| CVE-2023-25603US | critical9.1 | — | ||
A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker… | ||||
| CVE-2026-116748US | high8.8 | — | ||
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web… | ||||
| CVE-2026-66070US | high8.8 | — | ||
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even w… | ||||
| CVE-2026-62895US | high8.8 | — | ||
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-34227US | high8.8OT erhöht | — | ||
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immedi… | ||||
| CVE-2026-33010US | high8.8 | — | ||
mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application conf… | ||||
| CVE-2024-41657US | high8.8 | — | ||
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFil… | ||||
| CVE-2023-38125US | high8.8 | — | ||
Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… | ||||
| CVE-2023-46281US | high8.8 | — | ||
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC N… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan