# CWE-346. Every Advisory and CVE whose sources give the weakness CWE-346, newest first. ## Records, newest first (an older page) - [Kirby .dev domains and some reverse proxy setups were treated as local](https://agentprime.io/advisories/GHSA-2ccx-2gf3-8xvv.md) `GHSA-2ccx-2gf3-8xvv`, `CVE-2020-26253`, `PKSA-ds8j-v9vb-tdbw`, `PKSA-wxk6-8g5k-kq8b` · Packagist `getkirby/cms` and 1 more: affected `>=3.0.0, <3.3.6`, fixed in `3.3.6` · CVSS 6.8 Medium · Not analysed yet · Published 14 Jan 2021 · Tags: CWE-346 - [CORS configuration is possibly vulnerable](https://agentprime.io/advisories/CVE-2020-26251.md) `CVE-2020-26251` · CVE record: open-zaak open-zaak · CVSS 4.7 Medium · Not analysed yet · Published 18 Dec 2020 · Tags: CWE-346 - [URL Spoofing Vulnerability in Bitdefender SafePay (VA-8958)](https://agentprime.io/advisories/CVE-2020-15733.md) `CVE-2020-15733` · CVE record: Bitdefender Antivirus Plus · CVSS 6.5 Medium · Not analysed yet · Published 14 Dec 2020 · Tags: CWE-346 - [Disabled Hostname Verification in Opencast](https://agentprime.io/advisories/GHSA-44cw-p2hm-gpf6.md) `GHSA-44cw-p2hm-gpf6`, `CVE-2020-26234` · Maven `org.opencastproject:opencast-kernel`: affected `<7.9 || >=8.0, <8.9`, fixed in `7.9`, `8.9` · CVSS 4.8 Medium · Not analysed yet · Published 8 Dec 2020 · Tags: Weak cryptography or TLS, CWE-346 - [Origin validation error in CodeMeter](https://agentprime.io/advisories/CVE-2020-14519.md) `CVE-2020-14519` · CVE record: CodeMeter · No CVSS score · Not analysed yet · Published 16 Sept 2020 · Tags: CWE-346 - [User Impersonation in converse.js](https://agentprime.io/advisories/GHSA-w973-2qcc-p78x.md) `GHSA-w973-2qcc-p78x`, `CVE-2017-5858` · npm `converse.js`: affected `<1.0.7 || >=2.0.0, <2.0.5`, fixed in `1.0.7`, `2.0.5` · CVSS 5.9 Medium · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-20, CWE-346 - [TLS Validation Vulnerability in Envoy](https://agentprime.io/advisories/CVE-2020-15104.md) `CVE-2020-15104` · CVE record: envoyproxy envoy · CVSS 4.6 Medium · Not analysed yet · Published 14 Jul 2020 · Tags: CWE-346 - [Backend Same-Site Request Forgery in TYPO3 CMS](https://agentprime.io/advisories/GHSA-pqg8-crx9-g8m4.md) `GHSA-pqg8-crx9-g8m4`, `BIT-typo3-2020-11069`, `CVE-2020-11069`, `PKSA-ttpr-h5zy-14x1`, `PKSA-vncq-mbcp-6vyd` · Packagist `typo3/cms` and 1 more: affected `>=9.0.0, <9.5.17 || >=10.0.0, <10.4.2`, fixed in `9.5.17`, `10.4.2` · CVSS 8.0 High · Not analysed yet · Published 13 May 2020 · Tags: Cross-site request forgery (CSRF), CWE-346 - [ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissi…](https://agentprime.io/advisories/CVE-2020-11868.md) `CVE-2020-11868` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 17 Apr 2020 · Tags: CWE-346 - [Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library](https://agentprime.io/advisories/GHSA-63qc-p2x4-9fgf.md) `GHSA-63qc-p2x4-9fgf`, `CVE-2019-11777` · Maven `org.eclipse.paho:org.eclipse.paho.client.mqttv3`: affected `<1.2.1`, fixed in `1.2.1` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2019 · Tags: CWE-346, CWE-755 - [The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit](https://agentprime.io/advisories/CVE-2019-9499.md) `CVE-2019-9499` · CVE record: Wi-Fi Alliance hostapd with EAP-pwd support and 3 more · No CVSS score · Not analysed yet · Published 17 Apr 2019 · Tags: CWE-346 - [The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-Commit](https://agentprime.io/advisories/CVE-2019-9498.md) `CVE-2019-9498` · CVE record: Wi-Fi Alliance hostapd with EAP-pwd support and 3 more · No CVSS score · Not analysed yet · Published 17 Apr 2019 · Tags: CWE-346 - [Origin validation error in Logitech Harmony Hub](https://agentprime.io/advisories/CVE-2018-15723.md) `CVE-2018-15723` · CVE record: Logitech Logitech Harmony Hub · No CVSS score · Not analysed yet · Published 20 Dec 2018 · Tags: CWE-346 - [The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, res…](https://agentprime.io/advisories/CVE-2018-5400.md) `CVE-2018-5400` · CVE record: Auto-Maskin DCU-210E and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2018 · Tags: CWE-346 - [Origin validation error in Advantech WebAccess](https://agentprime.io/advisories/CVE-2018-10591.md) `CVE-2018-10591` · CVE record: Advantech WebAccess · No CVSS score · Not analysed yet · Published 15 May 2018 · Tags: CWE-346 - [avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (tra…](https://agentprime.io/advisories/CVE-2017-6519.md) `CVE-2017-6519` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 May 2017 · Tags: CWE-346 - [The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain p…](https://agentprime.io/advisories/CVE-2015-4495.md) `CVE-2015-4495` · CVE record · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.69 · Not analysed yet · Published 8 Aug 2015 · Tags: CWE-346 - [Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery](https://agentprime.io/advisories/CVE-2009-4139.md) `CVE-2009-4139` · CVE record: Red Hat Red Hat Network Satellite Server v 5.4 and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 27 Jul 2011 · Tags: CWE-346 Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .