The product does not properly verify that the source of data or communication is valid.
692 vulnerabilities with CWE-346
CVE-2018-4319
HIGH
iCloud < 7.7, iTunes < 12.9, Safari < 12, iPhone OS < 12.0 - Cross-Origin Security Bypass via Iframe Origin Tracking
CVSS 8.1
CVE-2018-18499
MEDIUM
Firefox < 62.0 and Firefox ESR < 60.2 - Same-Origin Policy Violation via Meta Refresh and performance.getEntries()
CVSS 6.5
CVE-2018-18494
MEDIUM
Firefox < 64 - Same-Origin Policy Bypass via performance.getEntries()
CVSS 6.5
CVE-2018-12402
MEDIUM
WebBrowserPersist - Info Disclosure
CVSS 6.5
CVE-2018-20745
MEDIUM
Yii 2.x through 2.0.15.1 - Origin Validation Error in CORS Policy Handling
CVSS 5.9
CVE-2018-20744
MEDIUM
go_cors < 1.3.0 - Origin Validation Error via Wildcard CORS Policy
CVSS 5.9
CVE-2018-16072
MEDIUM
Chrome < 69.0.3497.81 - Origin Validation Error via HLS Manifest Handling
CVSS 6.5
CVE-2018-15723
CRITICAL
Logitech Harmony Hub < 4.15.206 - Unauthenticated Command Injection via Crafted HTTP Request
CVSS 9.8
CVE-2018-5400
CRITICAL
Auto-Maskin DCU-210E & RP-210E <3.7 - Unauthenticated Modbus Spoofing via UDP
CVSS 9.1
CVE-2018-6690
HIGH
McAfee Application and Change Control <= 8.0.0 Hotfix 4 - Authenticated Arbitrary Code Execution via File Transfer
CVSS 7.1
CVE-2018-14903
HIGH
EPSON WF-2750 Firmware JP02I2 - Unauthenticated Firmware Update Validation Bypass
CVSS 7.5
CVE-2018-3834
HIGH
Insteon Hub Firmware 1013 - Permanent Denial of Service via Unsigned Firmware Flash
CVSS 7.4
CVE-2018-8235
MEDIUM
Microsoft Edge - Origin Validation Error
CVSS 4.3
CVE-2018-5157
HIGH
Firefox <60, Firefox ESR <52.8 - SSRF
CVSS 7.5
CVE-2018-5116
CRITICAL
Firefox < 58 - Origin Validation Error via WebExtensions ActiveTab Permission
CVSS 9.8
CVE-2018-5109
MEDIUM
Firefox < 58 - Origin Validation Error in Audio Capture Request
CVSS 5.3
CVE-2018-10591
MEDIUM
Advantech WebAccess <8.2_20170817, Dashboard <2.0.15, Scada Node <8.3.1, NMS <2.0.3 - Origin Validation Error
CVSS 6.1
CVE-2018-8112
MEDIUM
Microsoft Edge - Origin Validation Error
CVSS 4.3
CVE-2018-6764
HIGH
libvirt - Arbitrary Command Execution via Crafted NSS Module
CVSS 7.8
CVE-2018-6654
HIGH
Grammarly - Unauthenticated Authentication Token Exposure via iframe.gr_-ifr Request
CVSS 8.8
CVE-2017-20146
CRITICAL
Gorilla Handlers < 1.3.0 - CORS Header Bypass
CVSS 9.8
CVE-2017-7808
MEDIUM
Firefox < 55.0 - Cross-Origin Information Leak via CSP frame-ancestors Path Comparison
CVSS 5.3
CVE-2017-7797
HIGH
Firefox < 55.0 - Origin Validation Error via Response Header Name Interning
CVSS 7.5
CVE-2017-13274
CRITICAL
Android 6.0-8.1 - Origin Validation Error in UriTest.java getHost()
CVSS 9.8
CVE-2017-18016
MEDIUM
Parity Browser <= 1.6.10 - Origin Validation Error via Web Proxy Engine
CVSS 5.3
Details
Vulnerabilities
692