Advisories · Weakness
CWE-346.
Every Advisory and CVE whose sources give the weakness CWE-346, newest first.
- CVSS 6.8 Medium
Kirby .dev domains and some reverse proxy setups were treated as local
- CWE-346
>=3.0.0, <3.3.6 · fixed in 3.3.6
GHSA-2ccx-2gf3-8xvv · CVE-2020-26253 - CVSS 4.7 Medium
CORS configuration is possibly vulnerable
- open-zaak
- CWE-346
- CVSS 6.5 Medium
URL Spoofing Vulnerability in Bitdefender SafePay (VA-8958)
- Bitdefender Antivirus Plus
- CWE-346
- CVSS 4.8 Medium
Disabled Hostname Verification in Opencast
- Weak cryptography or TLS
- CWE-346
<7.9 || >=8.0, <8.9 · fixed in 7.9, 8.9
GHSA-44cw-p2hm-gpf6 · CVE-2020-26234 -
Origin validation error in CodeMeter
- CodeMeter
- CWE-346
- CVSS 5.9 Medium
User Impersonation in converse.js
- CWE-20
- CWE-346
<1.0.7 || >=2.0.0, <2.0.5 · fixed in 1.0.7, 2.0.5
GHSA-w973-2qcc-p78x · CVE-2017-5858 - CVSS 4.6 Medium
TLS Validation Vulnerability in Envoy
- envoy
- CWE-346
- CVSS 8.0 High
Backend Same-Site Request Forgery in TYPO3 CMS
- Cross-site request forgery (CSRF)
- CWE-346
>=9.0.0, <9.5.17 || >=10.0.0, <10.4.2 · fixed in 9.5.17, 10.4.2
GHSA-pqg8-crx9-g8m4 · CVE-2020-11069 - CVSS 5.9 Medium
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissi…
- CWE-346
- CVSS 7.5 High
Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library
- CWE-346
- CWE-755
<1.2.1 · fixed in 1.2.1
GHSA-63qc-p2x4-9fgf · CVE-2019-11777 -
The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit
- Wi-Fi Alliance hostapd with EAP-pwd support
- Wi-Fi Alliance wpa_supplicant with EAP-pwd support
- CWE-346
-
The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-Commit
- Wi-Fi Alliance hostapd with EAP-pwd support
- Wi-Fi Alliance wpa_supplicant with EAP-pwd support
- CWE-346
-
Origin validation error in Logitech Harmony Hub
- Logitech Harmony Hub
- CWE-346
- CVSS 9.1 CriticalCritical · CVSS 9+
The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, res…
- Auto-Maskin DCU-210E
- Auto-Maskin RP-210E
- CWE-346
-
Origin validation error in Advantech WebAccess
- Advantech WebAccess
- CWE-346
- CVSS 9.1 CriticalCritical · CVSS 9+
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (tra…
- CWE-346
- CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain p…
- CWE-346
- CVSS 6.8 Medium
Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery
- Red Hat Network Satellite Server v 5.4
- Red Hat Enterprise Linux 6
- CWE-346