İçeriğe atla
Noroxi

CWE-1385 · 33 kayıt

Missing Origin Validation in WebSockets

Bu sınıftaki CVE’ler

33 kayıt

  • CVE-2024-23168
    39İzleyin

    Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting i

    KritikCVSS 9,8İstismar yokEPSS %0

    15 Ağu 2024

  • CVE-2014-125071
    39İzleyin

    lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets

    KritikCVSS 9,8İstismar yokEPSS %0

    gribbit project · gribbit9 Oca 2023

  • CVE-2023-0957
    38İzleyin

    An issue was discovered in Gitpod versions prior to release-2022.11.2.16.

    KritikCVSS 9,6İstismar yokEPSS %0

    gitpod · gitpod3 Mar 2023

  • CVE-2023-26114
    37İzleyin

    Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.

    KritikCVSS 9,3İstismar yokEPSS %0

    coder · code-server23 Mar 2023

  • CVE-2026-85183
    37İzleyin

    Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

    KritikCVSS 9,3İstismar yokEPSS %0

    avaiga · taipy3 Eyl 2026

  • CVE-2026-35589
    37İzleyin

    nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)

    KritikCVSS 9,3İstismar yokEPSS %0

    nanobot · nanobot14 Nis 2026

  • CVE-2024-48849
    35İzleyin

    Authentication and Authorization Issues

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    abb · flxeon29 Oca 2025

  • CVE-2025-24964
    35İzleyin

    Remote Code Execution when accessing a malicious website while Vitest API server is listening

    YüksekCVSS 8,8İstismar yokEPSS %1

    vitest.dev · vitest4 Şub 2025

  • CVE-2023-49805
    35İzleyin

    Uptime Kuma Missing Origin Validation in WebSockets

    YüksekCVSS 8,8İstismar yokEPSS %0

    dockge.kuma · dockge11 Ara 2023

  • CVE-2023-2848
    35İzleyin

    Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability.

    YüksekCVSS 8,8İstismar yokEPSS %0

    movim · movim14 Eyl 2023

  • CVE-2025-52882
    35İzleyin

    Claude Code IDE extensions allow websocket connections from arbitrary origins

    YüksekCVSS 8,8İstismar yokEPSS %0

    anthropics · claude-code24 Haz 2025

  • CVE-2026-57111
    30İzleyin

    Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache · helix9 Tem 2026

  • CVE-2025-54289
    29İzleyin

    Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API

    YüksekCVSS 7,4İstismar yokEPSS %0

    canonical · lxd2 Eki 2025

  • CVE-2026-15580
    27İzleyin

    PassPortal browser extension: vault token disclosure via unvalidated postMessage

    OrtaCVSS 6,9İstismar yokEPSS %0

    n-able · passportal21 Ağu 2026

  • CVE-2025-61987
    27İzleyin

    GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.

    OrtaCVSS 6,9İstismar yokEPSS %0

    groupsession · groupsession12 Ara 2025

  • CVE-2025-68930
    26İzleyin

    Traccar Missing Origin Validation in WebSockets

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    traccar · traccar23 Şub 2026

  • CVE-2026-22689
    26İzleyin

    Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

    OrtaCVSS 6,5İstismar yokEPSS %0

    axllent · mailpit10 Oca 2026

  • CVE-2025-56647
    26İzleyin

    npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket.

    OrtaCVSS 6,5İstismar yokEPSS %0

    12 Şub 2026

  • CVE-2026-44514
    26İzleyin

    Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users

    OrtaCVSS 6,5İstismar yokEPSS %0

    kubetail-org · kubetail14 May 2026

  • CVE-2025-36116
    25İzleyin

    IBM Db2 Mirror for i cross-site websocket hijacking

    OrtaCVSS 6,3İstismar yokEPSS %0

    ibm · db2 mirror for i23 Tem 2025

  • CVE-2023-32264
    23İzleyin

    CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2.

    OrtaCVSS 5,8İstismar yokEPSS %0

    opentext · documentum d28 Mar 2024

  • CVE-2026-34403
    22İzleyin

    Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

    OrtaCVSS 5,5İstismar yokEPSS %0

    nginxui · nginx ui20 Nis 2026

  • CVE-2024-51775
    21İzleyin

    Apache Zeppelin: Command Injection via CSWSH

    OrtaCVSS 5,3İstismar yokEPSS %0

    apache · zeppelin3 Ağu 2025

  • CVE-2026-13272
    21İzleyin

    Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

    OrtaCVSS 5,4İstismar yokEPSS %0

    ibm · verify identity access14 Eyl 2026

  • CVE-2024-8201
    21İzleyin

    Cross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center Analyzer

    OrtaCVSS 5,4İstismar yokEPSS %0

    hitachi · hitachi ops center analyzer16 May 2025

Tüm zafiyet sınıfları