# CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

## Records, newest first (an older page)

- [An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server.](https://agentprime.io/advisories/CVE-2023-27745.md)
  `CVE-2023-27745` · CVE record · CVSS 8.8 High · Not analysed yet · Published 2 Jun 2023 · Tags: CWE-346
- [Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning message.](https://agentprime.io/advisories/CVE-2023-33740.md)
  `CVE-2023-33740` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 May 2023 · Tags: CWE-346
- [Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.](https://agentprime.io/advisories/CVE-2023-30196.md)
  `CVE-2023-30196` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 May 2023 · Tags: CWE-346
- [An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.](https://agentprime.io/advisories/CVE-2023-29745.md)
  `CVE-2023-29745` · CVE record · CVSS 7.1 High · Not analysed yet · Published 30 May 2023 · Tags: CWE-346
- [An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.](https://agentprime.io/advisories/CVE-2023-29743.md)
  `CVE-2023-29743` · CVE record · CVSS 7.5 High · Not analysed yet · Published 30 May 2023 · Tags: CWE-346
- [The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack.](https://agentprime.io/advisories/CVE-2023-29728.md)
  `CVE-2023-29728` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 May 2023 · Tags: CWE-346
- [An issue was discovered in Faronics Insight 10.0.19045 on Windows.](https://agentprime.io/advisories/CVE-2023-28349.md)
  `CVE-2023-28349` · CVE record · CVSS 8.8 High · Not analysed yet · Published 30 May 2023 · Tags: CWE-346
- [Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.](https://agentprime.io/advisories/CVE-2023-23561.md)
  `CVE-2023-23561` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 30 May 2023 · Tags: CWE-346
- [Jenkins SAML Single Sign On(SSO) Plugin missing hostname validation](https://agentprime.io/advisories/GHSA-6v6h-rw43-97fh.md)
  `GHSA-6v6h-rw43-97fh`, `CVE-2023-32993` · Maven `io.jenkins.plugins:miniorange-saml-sp`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 4.8 Medium · Not analysed yet · Published 16 May 2023 · Tags: CWE-345, CWE-346
- [Origin validation error in Seiko Solutions Inc. SkyBridge MB-A200](https://agentprime.io/advisories/CVE-2023-23578.md)
  `CVE-2023-23578` · CVE record: Seiko Solutions Inc. SkyBridge MB-A200 · CVSS 7.5 High · Not analysed yet · Published 10 May 2023 · Tags: CWE-346
- [Improper authorization in Rocket.Chat](https://agentprime.io/advisories/CVE-2023-28318.md)
  `CVE-2023-28318` · CVE record: Rocket.Chat · CVSS 5.3 Medium · Not analysed yet · Published 9 May 2023 · Tags: Broken access control, CWE-346
- [Origin validation error in Apple macOS](https://agentprime.io/advisories/CVE-2023-27962.md)
  `CVE-2023-27962` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 8 May 2023 · Tags: CWE-346
- [Origin validation error in Apple macOS](https://agentprime.io/advisories/CVE-2023-27944.md)
  `CVE-2023-27944` · CVE record: Apple macOS · CVSS 8.6 High · Not analysed yet · Published 8 May 2023 · Tags: CWE-346
- [Origin validation error in Apple macOS and others](https://agentprime.io/advisories/CVE-2023-27932.md)
  `CVE-2023-27932` · CVE record: Apple macOS and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 May 2023 · Tags: CWE-346
- [Origin validation error in Devolutions Server](https://agentprime.io/advisories/CVE-2023-2445.md)
  `CVE-2023-2445` · CVE record: Devolutions Devolutions Server · CVSS 4.9 Medium · Not analysed yet · Published 2 May 2023 · Tags: CWE-346
- [Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2023-29868.md)
  `CVE-2023-29868` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 2 May 2023 · Tags: CWE-346
- [Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2023-29867.md)
  `CVE-2023-29867` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 2 May 2023 · Tags: CWE-346
- [eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution](https://agentprime.io/advisories/CVE-2023-30856.md)
  `CVE-2023-30856` · CVE record: GitSquared edex-ui · CVSS 8.3 High · Not analysed yet · Published 28 Apr 2023 · Tags: CWE-346, CWE-1385
- [code-server vulnerable to Missing Origin Validation in WebSockets](https://agentprime.io/advisories/GHSA-frjg-g767-7363.md)
  `GHSA-frjg-g767-7363`, `CVE-2023-26114` · npm `code-server`: affected `<4.10.1`, fixed in `4.10.1` · CVSS 8.2 High · Not analysed yet · Published 23 Mar 2023 · Tags: CWE-346, CWE-1385
- [WAGO: Origin validation error through CORS misconfiguration](https://agentprime.io/advisories/CVE-2022-45139.md)
  `CVE-2022-45139` · CVE record: WAGO Compact Controller CC100 (751-9301) and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2023 · Tags: CWE-346
- [Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.](https://agentprime.io/advisories/CVE-2021-33959.md)
  `CVE-2021-33959` · CVE record · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 18 Jan 2023 · Tags: CWE-346
- [Zip4j Origin Validation Error](https://agentprime.io/advisories/GHSA-2pj2-gchf-wmw7.md)
  `GHSA-2pj2-gchf-wmw7`, `CVE-2023-22899` · Maven `net.lingala.zip4j:zip4j`: affected `<2.11.3`, fixed in `2.11.3` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jan 2023 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2023-0132.md)
  `CVE-2023-0132` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 10 Jan 2023 · Tags: CWE-346
- [Origin validation error in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2022-42927.md)
  `CVE-2022-42927` · CVE record: Mozilla Firefox and 2 more · CVSS 8.1 High · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-346
- [Origin validation error in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2022-38472.md)
  `CVE-2022-38472` · CVE record: Mozilla Thunderbird and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-346
- [Origin validation error in Mozilla Firefox](https://agentprime.io/advisories/CVE-2022-29915.md)
  `CVE-2022-29915` · CVE record: Mozilla Firefox · CVSS 4.3 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-346
- [Origin validation error in Mozilla Thunderbird](https://agentprime.io/advisories/CVE-2022-1520.md)
  `CVE-2022-1520` · CVE record: Mozilla Thunderbird · CVSS 4.3 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-346
- [BigBlueButton subject to Ineffective user bans](https://agentprime.io/advisories/CVE-2022-41961.md)
  `CVE-2022-41961` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 16 Dec 2022 · Tags: CWE-345, CWE-346
- [Phoenix before 1.6.14 mishandles check_origin wildcarding](https://agentprime.io/advisories/GHSA-p8f7-22gq-m7j9.md)
  `GHSA-p8f7-22gq-m7j9`, `CVE-2022-42975` · Hex `phoenix`: affected `<1.6.14`, fixed in `1.6.14` · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2022 · Tags: Broken access control, CWE-346
- [Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.](https://agentprime.io/advisories/GHSA-824x-jcxf-hpfg.md)
  `GHSA-824x-jcxf-hpfg`, `CVE-2022-3457`, `PYSEC-2022-43161` · PyPI `rdiffweb`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 3.7 Low · Not analysed yet · Published 13 Oct 2022 · Tags: CWE-346
- [Origin validation error in Apple Safari and others](https://agentprime.io/advisories/CVE-2022-22637.md)
  `CVE-2022-22637` · CVE record: Apple Safari and 2 more · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2022 · Tags: CWE-346
- [TERUTEN WebCube update remote code execution vulnerability](https://agentprime.io/advisories/CVE-2022-23764.md)
  `CVE-2022-23764` · CVE record: TERUTEN Co.,Ltd WebCube · CVSS 8.8 High · Not analysed yet · Published 17 Aug 2022 · Tags: CWE-346
- [undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect](https://agentprime.io/advisories/GHSA-q768-x9m6-m9qp.md)
  `GHSA-q768-x9m6-m9qp`, `CVE-2022-31151` · npm `undici`: affected `<5.8.0`, fixed in `5.8.0` · CVSS 3.7 Low · Not analysed yet · Published 21 Jul 2022 · Tags: Other injection, Open redirect, CWE-346
- [DOUZONE BIZON NeoRS file download and execute vulnerability](https://agentprime.io/advisories/CVE-2022-23763.md)
  `CVE-2022-23763` · CVE record: DOUZONE BIZON Co.,Ltd NeoRS · CVSS 7.8 High · Not analysed yet · Published 28 Jun 2022 · Tags: CWE-346
- [Origin validation error in Dominion Voting Systems ImageCast X firmware and others](https://agentprime.io/advisories/CVE-2022-1747.md)
  `CVE-2022-1747` · CVE record: Dominion Voting Systems ImageCast X firmware and 1 more · CVSS 4.6 Medium · Not analysed yet · Published 24 Jun 2022 · Tags: CWE-346
- [Origin validation error in Siemens SICAM GridEdge (Classic)](https://agentprime.io/advisories/CVE-2022-30228.md)
  `CVE-2022-30228` · CVE record: Siemens SICAM GridEdge (Classic) · CVSS 8.6 High · Not analysed yet · Published 14 Jun 2022 · Tags: CWE-346
- [Federated editing allows iframing remote servers by default in richdocuments](https://agentprime.io/advisories/CVE-2022-31024.md)
  `CVE-2022-31024` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2022 · Tags: Broken access control, CWE-346
- [CardGate Payments plugin for WooCommerce does not validate request origin](https://agentprime.io/advisories/GHSA-5pq5-9phv-q5j3.md)
  `GHSA-5pq5-9phv-q5j3`, `CVE-2020-8819`, `PKSA-txy6-xbmr-vmrx` · Packagist `cardgate/woocommerce`: affected `<3.1.16`, fixed in `3.1.16` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-346
- [Origin Validation Error in Apache NiFi](https://agentprime.io/advisories/GHSA-jvx9-rj3w-jq99.md)
  `GHSA-jvx9-rj3w-jq99`, `CVE-2017-7667` · Maven `org.apache.nifi:nifi`: affected `<0.7.4 || >=1.0.0, <1.3.0`, fixed in `0.7.4`, `1.3.0` · CVSS 7.5 High · Not analysed yet · Published 17 May 2022 · Tags: CWE-346
- [Yii Incorrectly Implements CORS](https://agentprime.io/advisories/GHSA-cr6r-6xm9-ww22.md)
  `GHSA-cr6r-6xm9-ww22`, `CVE-2018-20745`, `PKSA-9gg1-dnxr-781q` · Packagist `yiisoft/yii2`: affected `<2.0.16`, fixed in `2.0.16` · CVSS 5.9 Medium · Not analysed yet · Published 14 May 2022 · Tags: CWE-346
- [github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error](https://agentprime.io/advisories/GHSA-927h-x4qj-r242.md)
  `GHSA-927h-x4qj-r242`, `CVE-2018-20744`, `GO-2023-1792` · Go `github.com/gofiber/fiber/v2` and 1 more: affected `>=2.0.0, <2.43.0`, fixed in `2.43.0` · CVSS 5.9 Medium · Not analysed yet · Published 14 May 2022 · Tags: CWE-346
- [Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP](https://agentprime.io/advisories/GHSA-57q5-x8jf-g7h8.md)
  `GHSA-57q5-x8jf-g7h8`, `CVE-2017-7561` · Maven `org.jboss.resteasy:resteasy-jaxrs`: affected `>=3.0.7.Final, <3.0.25.Final || >=3.1.4.Final, <3.5.0.CR1`, fixed in `3.0.25.Final`, `3.5.0.CR1` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: HTTP request smuggling, CWE-346
- [RubyGems has Origin Validation Error vulnerability](https://agentprime.io/advisories/GHSA-73w7-6w9g-gc8w.md)
  `GHSA-73w7-6w9g-gc8w`, `CVE-2017-0902` · RubyGems `rubygems-update`: affected `<2.6.13`, fixed in `2.6.13` · CVSS 8.1 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-346, CWE-350
- [HashiCorp Consul vulnerable to Origin Validation Error](https://agentprime.io/advisories/GHSA-q7fx-wm2p-qfj8.md)
  `GHSA-q7fx-wm2p-qfj8`, `CVE-2019-9764`, `GO-2023-1853` · Go `github.com/hashicorp/consul`: affected `<1.4.4`, fixed in `1.4.4` · CVSS 7.4 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-346
- [Apache Knox allows impersonation of users](https://agentprime.io/advisories/GHSA-g3fc-8jv4-qmmv.md)
  `GHSA-g3fc-8jv4-qmmv`, `CVE-2017-5646` · Maven `org.apache.knox:gateway-provider-identity-assertion-common`: affected `>=0.2.0, <0.12.0`, fixed in `0.12.0` · CVSS 6.8 Medium · Not analysed yet · Published 13 May 2022 · Tags: CWE-346
- [Origin validation error in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-29818.md)
  `CVE-2022-29818` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.9 Low · Not analysed yet · Published 28 Apr 2022 · Tags: CWE-346
- [AVEVA System Platform Origin Validation Error](https://agentprime.io/advisories/CVE-2021-32985.md)
  `CVE-2021-32985` · CVE record: AVEVA AVEVA System Platform · CVSS 7.2 High · Not analysed yet · Published 4 Apr 2022 · Tags: CWE-346
- [Leaking of user information on Cross-Domain communication in sysend](https://agentprime.io/advisories/GHSA-4vvg-x86p-mvqc.md)
  `GHSA-4vvg-x86p-mvqc`, `CVE-2022-24762` · npm `sysend`: affected `<1.10.0`, fixed in `1.10.0` · CVSS 6.5 Medium · Not analysed yet · Published 14 Mar 2022 · Tags: Information disclosure, CWE-346
- [Liferay Portal and Liferay DXP fails to check origin of event messages](https://agentprime.io/advisories/GHSA-ghw5-998m-vw4w.md)
  `GHSA-ghw5-998m-vw4w`, `BIT-liferay-2022-25146`, `CVE-2022-25146` · Maven `com.liferay:com.liferay.remote.app.web` and 1 more: affected `<2.0.21`, fixed in `2.0.21` · CVSS 5.3 Medium · Not analysed yet · Published 4 Mar 2022 · Tags: CWE-346
- [Cookie and header exposure in twisted](https://agentprime.io/advisories/GHSA-92x2-jw7w-xvvx.md)
  `GHSA-92x2-jw7w-xvvx`, `CVE-2022-21712`, `PYSEC-2022-27` · PyPI `twisted`: affected `>=11.1.0, <22.1.0`, fixed in `22.1.0` · CVSS 7.5 High · Not analysed yet · Published 7 Feb 2022 · Tags: Information disclosure, CWE-346
- [Origin validation error in BIG-IP Edge Client for Mac and Windows](https://agentprime.io/advisories/CVE-2022-23032.md)
  `CVE-2022-23032` · CVE record: BIG-IP Edge Client for Mac and Windows · No CVSS score · Not analysed yet · Published 25 Jan 2022 · Tags: CWE-346
- [Origin validation error in ZooZ ZEN25 and others](https://agentprime.io/advisories/CVE-2020-9060.md)
  `CVE-2020-9060` · CVE record: ZooZ ZEN25 and 4 more · No CVSS score · Not analysed yet · Published 7 Jan 2022 · Tags: Denial of service, CWE-346
- [Origin Validation Error in Magento 2](https://agentprime.io/advisories/GHSA-qf6q-qfwp-vp44.md)
  `GHSA-qf6q-qfwp-vp44`, `CVE-2020-8818`, `PKSA-63yn-hphh-7tpx` · Packagist `cardgate/magento2`: affected `<2.0.33`, fixed in `2.0.33` · CVSS 8.1 High · Not analysed yet · Published 12 Oct 2021 · Tags: CWE-346
- [Elvish vulnerable to remote code execution via the web UI backend](https://agentprime.io/advisories/GHSA-fpv6-f8jw-rc3r.md)
  `GHSA-fpv6-f8jw-rc3r`, `CVE-2021-41088`, `GO-2022-0937` · Go `github.com/elves/elvish`: affected `<0.14.0`, fixed in `0.14.0` · CVSS 8.0 High · Not analysed yet · Published 23 Sept 2021 · Tags: Information disclosure, CWE-346
- [Remote code execution in Eclipse Theia](https://agentprime.io/advisories/GHSA-v9w2-v7j9-rjpr.md)
  `GHSA-v9w2-v7j9-rjpr`, `CVE-2021-34435` · npm `@theia/mini-browser`: affected `>=0.3.9, <1.9.0`, fixed in `1.9.0` · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2021 · Tags: Information disclosure, CWE-346, CWE-942
- [Default CORS config allows any origin with credentials](https://agentprime.io/advisories/GHSA-52cf-226f-rhr6.md)
  `GHSA-52cf-226f-rhr6`, `CVE-2021-39185` · Maven `org.http4s:http4s-server_2.10` and 5 more: affected `*`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2021 · Tags: CWE-346
- [XSS vector in slide mode speaker-view](https://agentprime.io/advisories/CVE-2021-39175.md)
  `CVE-2021-39175` · CVE record: hedgedoc hedgedoc · CVSS 8.1 High · Not analysed yet · Published 30 Aug 2021 · Tags: Other injection, CWE-346
- [Improper Authorization and Origin Validation Error in OneFuzz](https://agentprime.io/advisories/GHSA-q5vh-6whw-x745.md)
  `GHSA-q5vh-6whw-x745`, `CVE-2021-37705`, `PYSEC-2021-344` · PyPI `onefuzz`: affected `>=2.12.0, <2.31.0`, fixed in `2.31.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2021 · Tags: Broken access control, CWE-346
- [Origin Validation Error in Apache Maven](https://agentprime.io/advisories/GHSA-2f88-5hg8-9x2x.md)
  `GHSA-2f88-5hg8-9x2x`, `BIT-maven-2021-26291`, `CVE-2021-26291` · Maven `org.apache.maven:maven-compat` and 1 more: affected `<3.8.1`, fixed in `3.8.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2021 · Tags: CWE-346
- [Podman Origin Validation Error](https://agentprime.io/advisories/GHSA-grh6-q6m2-rh72.md)
  `GHSA-grh6-q6m2-rh72`, `CVE-2021-20199` · Go `github.com/containers/podman/v3`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 18 May 2021 · Tags: Information disclosure, CWE-346

Newest: <https://agentprime.io/advisories/tag/cwe-346.md>
Older: <https://agentprime.io/advisories/tag/cwe-346.md?cursor=WyIyMDIxLTA1LTE4VDIxOjA3OjQ5LjAwMDAwMFoiLCJHSFNBLWdyaDYtcTZtMi1yaDcyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-346&cursor=WyIyMDIzLTA2LTAyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yODE2NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-346/?cursor=WyIyMDIzLTA2LTAyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yODE2NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.