The product does not properly verify that the source of data or communication is valid.
692 vulnerabilities with CWE-346
CVE-2023-3654
CRITICAL
cashit! < 03.a06rks_2023.02.37 - Origin Validation Error via Host Header
CVSS 9.4
CVE-2023-2848
HIGH
movim < 0.22 - Cross-Site WebSocket Hijacking via Missing Header Validation
CVSS 8.0
CVE-2023-29505
MEDIUM
ManageEngine Network Configuration Manager 12.6.165 - Cross-site WebSocket Hijacking via WebSocket Endpoint
CVSS 4.3
CVE-2023-4045
MEDIUM
Firefox < 116 - Origin Validation Error via Offscreen Canvas
CVSS 5.3
CVE-2023-30949
MEDIUM
Palantir Slate < 6.207.0 - Origin Validation Error
CVSS 4.3
CVE-2023-2850
MEDIUM
NodeBB < 2.8.13 and 3.0.0-3.1.3 - Cross-Site WebSocket Hijacking via Missing Origin Validation
CVSS 4.7
CVE-2023-3581
MEDIUM
Mattermost 7.8.0-7.8.6 - WebSocket Origin Validation Bypass
CVSS 6.2
CVE-2023-21260
MEDIUM
Android - Origin Validation Error via Notification Access Permission Dialog
CVSS 5.5
CVE-2023-37210
MEDIUM
Firefox < 115.0 - Full-Screen Mode Spoofing via Alert and Prompt Calls
CVSS 6.5
CVE-2023-32223
HIGH
D-Link DSL-224 Firmware 3.0.10 - Authenticated Command Execution
CVSS 8.8
CVE-2023-32553
MEDIUM
Trend Micro Apex One < 14.0.12105 - Unauthenticated Sensitive Information Disclosure
CVSS 5.3
CVE-2023-28191
MEDIUM
iPadOS < 16.5 - Privacy Preferences Bypass via Sensitive Information Redaction
CVSS 5.5
CVE-2023-29711
CRITICAL
Interlink PSG-5124 Firmware 1.0.4 - Remote Code Execution via Crafted GET Request
CVSS 9.8
CVE-2023-25188
MEDIUM
NOKIA Airscale ASIKA Single RAN < 21B - Unauthenticated Privilege Escalation via AaShell Diagnostic Tool
CVSS 5.1
CVE-2023-25366
CRITICAL
Siglent SDS 1104X-E Firmware SDS1xx4X-E_V6.1.37R9.ADS - Unauthenticated Web Password Disclosure via SCPI Interface
CVSS 9.8
CVE-2023-2639
MEDIUM
Rockwell FactoryTalk System Services - Local WebSocket Origin Validation Bypass
CVSS 4.1
CVE-2023-29753
MEDIUM
Facemoji Emoji Keyboard 2.9.1.2 - Denial of Service via SharedPreference Files
CVSS 5.5
CVE-2023-29751
MEDIUM
Yandex Navigator 6.60 - Denial of Service via SharedPreference Manipulation
CVSS 5.5
CVE-2023-29756
MEDIUM
Twilight 13.3 - Denial of Service via SharedPreference Manipulation
CVSS 5.5
CVE-2023-33443
CRITICAL
BES-6024PB-I50H1 VideoPlayTool <2.0.1.0 - Command Injection
CVSS 9.8
CVE-2023-2589
MEDIUM
GitLab 12.0-15.10.7, 15.11-15.11.6, 16.0-16.0.1 - IP Restriction Bypass via Repository Clone
CVSS 5.9
CVE-2023-28164
MEDIUM
Firefox < 111.0 and Firefox ESR < 102.9 - Origin Validation Error via Cross-Origin Iframe Drag
CVSS 6.5
CVE-2023-23601
MEDIUM
Firefox < 109 and Firefox ESR < 102.7 - Origin Validation Error via Cross-Origin URL Drag
CVSS 6.5
CVE-2023-27745
HIGH
TitanFTP NextGen < 2.0.1.2102 - Privilege Escalation via User Server Request
CVSS 8.8
CVE-2023-29745
HIGH
BestWeather 7.3.1 - Denial of Service via Database Manipulation
CVSS 7.1
Details
Vulnerabilities
692