CWE-942 · 94 kayıt
Permissive Cross-domain Security Policy with Untrusted Domains
Bu sınıftaki CVE’ler
94 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2022-31736İstismar yok | A malicious website could have learned the size of a cross-origin resource that supported Range requests.mozilla · firefox · CWE-942 | Kritik9,8 | — | %1,1 | 22 Ara 2022 |
39İzleyin | CVE-2022-26969İstismar yok | In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.monospace · directus · CWE-942 | Kritik9,8 | — | %0,9 | 26 Ara 2022 |
39İzleyin | CVE-2021-27786İstismar yok | HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trustedhcltech · onetest server · CWE-942 | Kritik9,8 | — | %0,6 | 9 Haz 2022 |
39İzleyin | CVE-2024-37131İstismar yok | SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability.dell · policy manager for secure connect gateway · CWE-942 | Kritik9,8 | — | %0,5 | 13 Haz 2024 |
39İzleyin | CVE-2023-50940İstismar yok | IBM PowerSC cross-resource origin sharingibm · powersc · CWE-942 | Kritik9,8 | — | %0,5 | 1 Şub 2024 |
39İzleyin | CVE-2026-15966İstismar yok | Improper CORS handling in MOVEit Transferprogress · moveit transfer · CWE-942 | Kritik9,8 | — | %0,4 | 23 Tem 2026 |
39İzleyin | CVE-2025-61163İstismar yok | Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.CWE-942 | Kritik9,8 | — | %0,3 | 26 Ağu 2026 |
39İzleyin | CVE-2025-27909İstismar yok | IBM Concert Software cross-origin resource sharingibm · concert · CWE-942 | Kritik9,8 | — | %0,2 | 18 Ağu 2025 |
38İzleyin | CVE-2026-34449İstismar yok | SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injectionb3log · siyuan · CWE-942 | Kritik9,6 | — | %0,8 | 31 Mar 2026 |
37İzleyin | CVE-2026-61736Kavram kanıtı | LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requestshkuds · lightrag · CWE-942 | Kritik9,3 | — | %1,4 | 15 Tem 2026 |
37İzleyin | CVE-2026-9739İstismar yok | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790).google · mcp toolbox for databases · CWE-942 | Kritik9,4 | — | %0,2 | 27 May 2026 |
36İzleyin | CVE-2026-8948İstismar yok | Same-origin policy bypass in the DOM: Networking componentmozilla · firefox · CWE-942 | Kritik9,1 | — | %0,5 | 19 May 2026 |
36İzleyin | CVE-2026-30924İstismar yok | qui CORS Misconfiguration: Arbitrary Origins Trustedgetqui · qui · CWE-942 | Kritik9,0 | — | %0,4 | 19 Mar 2026 |
36İzleyin | CVE-2023-25603İstismar yok | A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.fortinet · fortiadc · CWE-942 | Kritik9,1 | — | %0,4 | 14 Kas 2023 |
35İzleyin | CVE-2023-38125İstismar yok | Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerabilitysofting · edgeaggregator · CWE-942 | Yüksek8,8 | — | %1,3 | 2 May 2024 |
35İzleyin | CVE-2023-46281İstismar yok | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIsiemens · opcenter quality · CWE-942 | Yüksek8,8 | — | %0,9 | 12 Ara 2023 |
35İzleyin | CVE-2024-41657İstismar yok | GHSL-2024-035: Casdoor CORS misconfigurationcasbin · casdoor · CWE-942 | Yüksek8,8 | — | %0,8 | 20 Ağu 2024 |
35İzleyin | CVE-2023-46098İstismar yok | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1).siemens · simatic pcs neo · CWE-942 | Yüksek8,8 | — | %0,6 | 14 Kas 2023 |
35İzleyin | CVE-2021-34435İstismar yok | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE.eclipse · theia · CWE-942 | Yüksek8,8 | — | %0,6 | 1 Eyl 2021 |
35İzleyin | CVE-2026-33010İstismar yok | mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theftdoobidoo · mcp-memory-service · CWE-942 | Yüksek8,8 | — | %0,5 | 20 Mar 2026 |
34İzleyin | CVE-2026-56076İstismar yok | PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpointpraisonai · praisonai · CWE-942 | Yüksek8,6 | — | %0,7 | 18 Haz 2026 |
34İzleyin | CVE-2024-49763İstismar yok | PlexRipper allows API leak due to open CORS policyplexripper · plexripper · CWE-942 | Yüksek8,7 | — | %0,5 | 2 Ara 2024 |
34İzleyin | CVE-2026-82287İstismar yok | Rybbit Reflects Any Origin in CORS Responses While Allowing Credentialsrybbit-io · rybbit · CWE-942 | Yüksek8,6 | — | %0,5 | 28 Ağu 2026 |
34İzleyin | CVE-2026-90882İstismar yok | Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataeclipse foundation · open-vsx.org · CWE-942 | Yüksek8,7 | — | %0,4 | 22 Eyl 2026 |
34İzleyin | CVE-2025-30354İstismar yok | Bruno ignores Safe-Mode in Asserts expressionsusebruno · bruno · CWE-942 | Yüksek8,7 | — | %0,4 | 1 Nis 2025 |
- CVE-2022-3173639İzleyin
A malicious website could have learned the size of a cross-origin resource that supported Range requests.
KritikCVSS 9,8İstismar yokEPSS %1mozilla · firefox22 Ara 2022
- CVE-2022-2696939İzleyin
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
KritikCVSS 9,8İstismar yokEPSS %1monospace · directus26 Ara 2022
- CVE-2021-2778639İzleyin
HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted
KritikCVSS 9,8İstismar yokEPSS %1hcltech · onetest server9 Haz 2022
- CVE-2024-3713139İzleyin
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability.
KritikCVSS 9,8İstismar yokEPSS %0dell · policy manager for secure connect gateway13 Haz 2024
- CVE-2023-5094039İzleyin
IBM PowerSC cross-resource origin sharing
KritikCVSS 9,8İstismar yokEPSS %0ibm · powersc1 Şub 2024
- CVE-2026-1596639İzleyin
Improper CORS handling in MOVEit Transfer
KritikCVSS 9,8İstismar yokEPSS %0progress · moveit transfer23 Tem 2026
- CVE-2025-6116339İzleyin
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2025-2790939İzleyin
IBM Concert Software cross-origin resource sharing
KritikCVSS 9,8İstismar yokEPSS %0ibm · concert18 Ağu 2025
- CVE-2026-3444938İzleyin
SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
KritikCVSS 9,6İstismar yokEPSS %1b3log · siyuan31 Mar 2026
- CVE-2026-6173637İzleyin
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
KritikCVSS 9,3Kavram kanıtıEPSS %1hkuds · lightrag15 Tem 2026
- CVE-2026-973937İzleyin
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790).
KritikCVSS 9,4İstismar yokEPSS %0google · mcp toolbox for databases27 May 2026
- CVE-2026-894836İzleyin
Same-origin policy bypass in the DOM: Networking component
KritikCVSS 9,1İstismar yokEPSS %0mozilla · firefox19 May 2026
- CVE-2026-3092436İzleyin
qui CORS Misconfiguration: Arbitrary Origins Trusted
KritikCVSS 9,0İstismar yokEPSS %0getqui · qui19 Mar 2026
- CVE-2023-2560336İzleyin
A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.
KritikCVSS 9,1İstismar yokEPSS %0fortinet · fortiadc14 Kas 2023
- CVE-2023-3812535İzleyin
Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability
YüksekCVSS 8,8İstismar yokEPSS %1softing · edgeaggregator2 May 2024
- CVE-2023-4628135İzleyin
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATI
YüksekCVSS 8,8İstismar yokEPSS %1siemens · opcenter quality12 Ara 2023
- CVE-2024-4165735İzleyin
GHSL-2024-035: Casdoor CORS misconfiguration
YüksekCVSS 8,8İstismar yokEPSS %1casbin · casdoor20 Ağu 2024
- CVE-2023-4609835İzleyin
A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1).
YüksekCVSS 8,8İstismar yokEPSS %1siemens · simatic pcs neo14 Kas 2023
- CVE-2021-3443535İzleyin
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE.
YüksekCVSS 8,8İstismar yokEPSS %1eclipse · theia1 Eyl 2021
- CVE-2026-3301035İzleyin
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
YüksekCVSS 8,8İstismar yokEPSS %0doobidoo · mcp-memory-service20 Mar 2026
- CVE-2026-5607634İzleyin
PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
YüksekCVSS 8,6İstismar yokEPSS %1praisonai · praisonai18 Haz 2026
- CVE-2024-4976334İzleyin
PlexRipper allows API leak due to open CORS policy
YüksekCVSS 8,7İstismar yokEPSS %1plexripper · plexripper2 Ara 2024
- CVE-2026-8228734İzleyin
Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials
YüksekCVSS 8,6İstismar yokEPSS %1rybbit-io · rybbit28 Ağu 2026
- CVE-2026-9088234İzleyin
Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data
YüksekCVSS 8,7İstismar yokEPSS %0eclipse foundation · open-vsx.org22 Eyl 2026
- CVE-2025-3035434İzleyin
Bruno ignores Safe-Mode in Asserts expressions
YüksekCVSS 8,7İstismar yokEPSS %0usebruno · bruno1 Nis 2025