CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

Parent: CWE-863 - Incorrect Authorization

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

115 vulnerabilities with CWE-942

CVE-2023-46281 HIGH

Siemens Opcenter Quality < V2312 - Permissive Cross-domain Security Policy

CVSS 7.1

CVE-2023-25603 MEDIUM

FortiADC 7.1.0-7.1.1 and FortiDDoS-F 6.3.0-6.3.4, 6.4.0-6.4.1 - Permissive Cross-domain Policy with Untrusted Domains

CVSS 5.4

CVE-2023-46098 HIGH

SIMATIC PCS neo < 4.1 - Permissive Cross-domain Security Policy with Untrusted Domains

CVSS 8.0

CVE-2023-36829 MEDIUM

Sentry 23.6.0-23.6.2 - Permissive Cross-domain Security Policy via Origin Header

CVSS 6.8

CVE-2023-2360 HIGH

Acronis Cyber Infrastructure <5.2.0-135 - Info Disclosure

CVSS 7.5

CVE-2023-23464 HIGH

Media Control Panel - Permissive Cross-domain Security Policy with Untrusted Domains

CVSS 8.1

CVE-2023-23128 MEDIUM

Connectwise Control 22.8.10013.8329 - Permissive Cross-domain Security Policy with Untrusted Domains

CVSS 6.1

CVE-2022-34366 MEDIUM

Dell SupportAssist < 3.11.2 Authenticated Information Disclosure via Cross-domain Whitelist

CVSS 6.5

CVE-2022-47717 HIGH

Last Yard 22.09.8-1 - Permissive Cross-domain Security Policy with Untrusted Domains

CVSS 7.5

CVE-2022-26969 CRITICAL

Directus < 9.7.0 - Permissive Cross-domain Security Policy with Untrusted Domains

CVSS 9.8

CVE-2022-31736 CRITICAL

Firefox < 101 and Firefox ESR < 91.10 - Cross-Origin Resource Size Leak via Range Requests

CVSS 9.8

CVE-2021-27786 MEDIUM

HCL OneTest Server - Permissive Cross-domain Security Policy with Untrusted Domains

CVSS 4.6

CVE-2021-34435 HIGH

Eclipse Theia 0.3.9-1.8.1 - Remote Code Execution via Mini-Browser HTML Preview

CVSS 8.8

CVE-2020-36851 CRITICAL

cors-anywhere - Unauthenticated Server-Side Request Forgery via Open Proxy Configuration

CVE-2019-14860 MEDIUM

Red Hat Fuse < 7.5.0 - Permissive Cross-domain Security Policy with Untrusted Domains

CVSS 6.5

Details

Vulnerabilities 115

Links