CWE-942
Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
97 vulnerabilities with CWE-942
CVE-2025-57755
HIGH
musistudio claude-code-router < 1.0.34 - Exposure of Sensitive Information via Improper CORS Configuration
CVE-2025-27909
MEDIUM
IBM Concert 1.0.0-1.1.0 - Permissive Cross-domain Security Policy with Untrusted Domains
CVSS 5.4
CVE-2025-25264
MEDIUM
WAGO CC100, PFC100, PFC200, TP600 - Unauthenticated Arbitrary File Read via CORS Misconfiguration
CVSS 6.5
CVE-2025-41366
MEDIUM
ZIV IDF and ZLF - High-Privilege CORS Misconfiguration
CVE-2025-41363
MEDIUM
ZIV IDF and ZLF - View-Permission CORS Misconfiguration
CVE-2025-4839
LOW
itwanger paicoding 1.0.0-1.0.3 - Permissive Cross-domain Security Policy in CrossUtil.java
CVSS 3.1
CVE-2025-4542
LOW
Freeebird Hotel < 1.2 - Permissive Cross-domain Security Policy with Untrusted Domains
CVSS 3.1
CVE-2025-4515
MEDIUM
pribai/privategpt < 0.6.2 - Permissive Cross-domain Security Policy via allow_origins Argument
CVSS 4.3
CVE-2025-25234
HIGH
Omnissa Unified Access Gateway < 2503 - CORS Bypass
CVSS 7.1
CVE-2025-30354
MEDIUM
Bruno < 1.39.1 - Unauthenticated Remote Code Execution via Malicious Collection Import
CVSS 4.3
CVE-2025-2865
MEDIUM
SaTECH BCU Firmware 2.1.3 - Stored Cross-Site Scripting via Untrusted Domain Resources
CVSS 6.1
CVE-2025-1083
LOW
Mindskip xzs-mysql 3.9.0 - Permissive Cross-domain Security Policy with Untrusted Domains in CORS Handler
CVSS 3.1
CVE-2024-11071
HIGH
Cyberdigm DestinyECM - Cross-Site Request Forgery via JSON Hijacking
CVSS 8.8
CVE-2024-22348
MEDIUM
IBM DevOps Velocity 5.0.0, IBM UrbanCode Velocity 4.0.0-4.0.25 - SSRF
CVSS 5.3
CVE-2024-53276
MEDIUM
home-gallery <= 1.15.0 - Permissive Cross-domain Security Policy in CORS Middleware
CVE-2024-49763
HIGH
PlexRipper < 0.24.0 - Unauthenticated Sensitive Information Exposure via CORS Misconfiguration
CVE-2024-45642
MEDIUM
IBM Security ReaQta 3.12-3.12.11 - Stored Cross-Site Scripting in Web UI
CVSS 5.3
CVE-2024-10315
MEDIUM
Gliffy Online <4.14.0-6 - Info Disclosure
CVE-2024-6449
MEDIUM
HyperView Geoportal Toolkit <8.5.0 - SSRF
CVSS 6.5
CVE-2024-41657
HIGH
Casdoor <= 1.577.0 - Authenticated Cross-Origin Request Forgery via Origin Header Prefix Check
CVSS 8.1
CVE-2024-41659
HIGH
memos < 0.21.0 - Unauthenticated CORS Misconfiguration with Credentials
CVSS 8.1
CVE-2024-32862
MEDIUM
ExacqVision Web Service < 24.03 - Permissive Cross-domain Security Policy with Untrusted Domains
CVSS 6.8
CVE-2024-37131
HIGH
Dell Policy Manager for Secure Connect Gateway 5.18.00.20-5.24.00.14 - Unauthenticated CORS Bypass
CVSS 7.5
CVE-2024-23823
MEDIUM
vantage6 < 4.2.1 and >=0 < 4.3.0 - Permissive Cross-domain Security Policy
CVSS 4.2
CVE-2024-25124
CRITICAL
Fiber < 2.52.1 - Insecure CORS Configuration with Wildcard Origin and Credentials
CVSS 9.4
Details
Vulnerabilities
97