CWE-346.

React Router has CSRF issue in Action/Server Action Request Processing

• Cross-site request forgery (CSRF)
• CWE-346

>=7.0.0, <7.12.0 · fixed in 7.12.0

Origin validation error in Trend Micro, Inc. Trend Micro Apex Central

• Trend Micro, Inc. Trend Micro Apex Central
• Memory corruption
• CWE-346

Origin validation error in Trend Micro, Inc. Trend Micro Apex Central

• Trend Micro, Inc. Trend Micro Apex Central
• Memory corruption
• CWE-346

Authentication bypass by spoofing in Trend Micro, Inc. Trend Micro Apex Central

• Trend Micro, Inc. Trend Micro Apex Central
• Memory corruption
• Authentication bypass

An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34.

• CWE-346

Origin validation error in Fujitsu Client Computing Limited Fujitsu Security Solution AuthConductor Client…

• Fujitsu Client Computing Limited Fujitsu Security Solution AuthConductor Client Basic V2
• CWE-346

Origin validation error in NAVER Whale browser

• NAVER Whale browser
• CWE-346

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

• Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
• CWE-346

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.

• CWE-346

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.

• CWE-346

Same-origin policy bypass in the Request Handling component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with ...

• CWE-346

<1.7.0 · fixed in 1.7.0

Origin validation error in Synology BeeDrive for desktop

• Synology BeeDrive for desktop
• CWE-346

Host header poisoning allows account takeover via password reset email

• MasaCMS
• CWE-346
• CWE-640

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

• webkitgtk
• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• CWE-346

Kibana Origin Validation Error

• Elastic Kibana
• CWE-346

Origin validation error in Google Chrome

• Google Chrome
• CWE-346

Nagios XI < 2024R1.2.2 Host Header Injection

• Nagios XI
• CWE-346

chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation

• chatwoot
• CWE-345
• CWE-346

Liferay Portal fails to verify messages from the cluster network is trusted

• CWE-346

<5.0.35 · fixed in 5.0.35

Origin validation error in NAVER Whale browser

• NAVER Whale browser
• CWE-346

API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products

• Kiloview NDI
• Authentication bypass
• CWE-346

IBM Engineering Requirements Management Doors Next spoofing

• IBM Engineering Requirements Management Doors Next
• CWE-346

Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor

• Juniper Networks Junos OS
• CWE-346

CrowdStrike Falcon Sensor for Windows Logic Error

• CrowdStrike Falcon sensor for Windows
• CWE-346

SillyTavern Web Interface Vulnerable DNS Rebinding

• CWE-346
• CWE-940

<1.13.4 · fixed in 1.13.4

CodeCanyon/ui-lib Mentor LMS API cross-domain policy

• CodeCanyon Mentor LMS
• ui-lib Mentor LMS
• CWE-346
• CWE-942

Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

• Cross-site request forgery (CSRF)
• CWE-346

<3.7.3 · fixed in 3.7.3

Origin validation error in Cisco Aironet Access Point Software (IOS XE Controller)

• Cisco Aironet Access Point Software (IOS XE Controller)
• CWE-346

Parcel has an Origin Validation Error vulnerability

• CWE-346

>=1.6.1, <2.16.4 · fixed in 2.16.4

Neo4j Cypher MCP server is vulnerable to DNS rebinding

• CWE-346

>=0.2.2, <0.4.0 · fixed in 0.4.0

Origin validation error in Google Chrome

• Google Chrome
• Broken access control
• CWE-346

pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability

• CWE-346

<9.8 · fixed in 9.8

Host Header Injection in Akinsoft's LimonDesk

• Akinsoft LimonDesk
• CWE-346

Host Header Injection in Akinsoft's OctoCloud

• Akinsoft OctoCloud
• CWE-346

github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

• Cross-site request forgery (CSRF)
• CWE-346

<=1.7.3 · no fixed version yet

An issue was discovered in Shopizer 3.2.7.

• CWE-346

elysia-cors Origin Validation Error

• CWE-178
• CWE-346

<1.3.1 · fixed in 1.3.1

Same-origin policy bypass in the Graphics: Canvas2D component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning

• HCL Software BigFix SaaS Remediate
• CWE-346

Origin validation error in Google Chrome

• Google Chrome
• Authentication bypass
• CWE-346

Origin validation error in Sipwise rtpengine

• Sipwise rtpengine
• CWE-346

Keycloak phishing attack via email verification step in first login flow

• CWE-346

<26.0.13 || >=26.2.0, <26.2.6 · fixed in 26.0.13, 26.2.6

Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow

• CWE-346

<26.3.0 · fixed in 26.3.0

Origin validation error in NAVER Whale browser

• NAVER Whale browser
• CWE-346

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability

• Autel MaxiCharger AC Wallbox Commercial
• CWE-346

Security misconfiguration vulnerability in SAP Business One Integration Framework

• SAP_SE SAP Business One Integration Framework
• CWE-346

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

• CWE-346

<5.2.1 · fixed in 5.2.1

MacOS Zscaler Client Connector Local Privilege Escalation

• Zscaler Client Connector
• CWE-346

Origin validation error in Apple Safari and others

• Apple Safari
• Apple iOS and iPadOS
• CWE-346

Gradio CORS Origin Validation Bypass Vulnerability

• CWE-345
• CWE-346

>=5.0.0, <=5.29.1 · no fixed version yet

Error handling for script execution was incorrectly isolated from web content

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

itwanger paicoding CrossUtil.java cross-domain policy

• itwanger paicoding
• CWE-346
• CWE-942

Origin Validation Error

• Schweitzer Engineering Laboratories SEL-5037 Grid Configurator
• CWE-346

Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy

• Freeebird Hotel 酒店管理系统 API
• CWE-346
• CWE-942

Zylon PrivateGPT settings.yaml cross-domain policy

• Zylon PrivateGPT
• CWE-346
• CWE-942

Origin validation error in ASUS DriverHub

• ASUS DriverHub
• CWE-346

@misskey-dev/summaly allows IP Filter Bypass via Redirect

• CWE-346

>=5.1.0, <5.2.1 · fixed in 5.2.1

Origin validation error in kitty

• kitty
• CWE-346

Command Injection in iManage Work Desktop for Mac's Agent Service

• iManage Work Desktop for Mac
• Information disclosure
• CWE-346