CWE-346.

An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server.

• CWE-346

Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning message.

• CWE-346

Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.

• CWE-346

An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.

• CWE-346

An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.

• CWE-346

The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack.

• CWE-346

An issue was discovered in Faronics Insight 10.0.19045 on Windows.

• CWE-346

Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.

• CWE-346

Jenkins SAML Single Sign On(SSO) Plugin missing hostname validation

• CWE-345
• CWE-346

<2.1.0 · fixed in 2.1.0

Origin validation error in Seiko Solutions Inc. SkyBridge MB-A200

• Seiko Solutions Inc. SkyBridge MB-A200
• CWE-346

Improper authorization in Rocket.Chat

• Rocket.Chat
• Broken access control
• CWE-346

Origin validation error in Apple macOS

• Apple macOS
• CWE-346

Origin validation error in Apple macOS

• Apple macOS
• CWE-346

Origin validation error in Apple macOS and others

• Apple macOS
• Apple Safari
• CWE-346

Origin validation error in Devolutions Server

• Devolutions Server
• CWE-346

Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control.

• CWE-346

Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control.

• CWE-346

eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

• GitSquared edex-ui
• CWE-346
• CWE-1385

code-server vulnerable to Missing Origin Validation in WebSockets

• CWE-346
• CWE-1385

<4.10.1 · fixed in 4.10.1

WAGO: Origin validation error through CORS misconfiguration

• WAGO Compact Controller CC100 (751-9301)
• WAGO Edge Controller (752-8303/8000-002)
• CWE-346

Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.

• CWE-346

Zip4j Origin Validation Error

• CWE-346

<2.11.3 · fixed in 2.11.3

Origin validation error in Google Chrome

• Google Chrome
• CWE-346

Origin validation error in Mozilla Firefox and others

• Mozilla Firefox
• Mozilla Firefox ESR
• CWE-346

Origin validation error in Mozilla Thunderbird and others

• Mozilla Thunderbird
• Mozilla Firefox ESR
• CWE-346

Origin validation error in Mozilla Firefox

• Mozilla Firefox
• CWE-346

Origin validation error in Mozilla Thunderbird

• Mozilla Thunderbird
• CWE-346

BigBlueButton subject to Ineffective user bans

• bigbluebutton
• CWE-345
• CWE-346

Phoenix before 1.6.14 mishandles check_origin wildcarding

• Broken access control
• CWE-346

<1.6.14 · fixed in 1.6.14

Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.

• CWE-346

<2.5.0 · fixed in 2.5.0

Origin validation error in Apple Safari and others

• Apple Safari
• Apple tvOS
• CWE-346

TERUTEN WebCube update remote code execution vulnerability

• TERUTEN Co.,Ltd WebCube
• CWE-346

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

• Other injection
• Open redirect

<5.8.0 · fixed in 5.8.0

DOUZONE BIZON NeoRS file download and execute vulnerability

• DOUZONE BIZON Co.,Ltd NeoRS
• CWE-346

Origin validation error in Dominion Voting Systems ImageCast X firmware and others

• Dominion Voting Systems ImageCast X firmware
• Dominion Voting Systems ImageCast X application
• CWE-346

Origin validation error in Siemens SICAM GridEdge (Classic)

• Siemens SICAM GridEdge (Classic)
• CWE-346

Federated editing allows iframing remote servers by default in richdocuments

• nextcloud security-advisories
• Broken access control
• CWE-346

CardGate Payments plugin for WooCommerce does not validate request origin

• CWE-346

<3.1.16 · fixed in 3.1.16

Origin Validation Error in Apache NiFi

• CWE-346

<0.7.4 || >=1.0.0, <1.3.0 · fixed in 0.7.4, 1.3.0

Yii Incorrectly Implements CORS

• CWE-346

<2.0.16 · fixed in 2.0.16

github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error

• CWE-346

>=2.0.0, <2.43.0 · fixed in 2.43.0

Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP

• HTTP request smuggling
• CWE-346

>=3.0.7.Final, <3.0.25.Final || >=3.1.4.Final, <3.5.0.CR1 · fixed in 3.0.25.Final, 3.5.0.CR1

RubyGems has Origin Validation Error vulnerability

• CWE-346
• CWE-350

<2.6.13 · fixed in 2.6.13

HashiCorp Consul vulnerable to Origin Validation Error

• CWE-346

<1.4.4 · fixed in 1.4.4

Apache Knox allows impersonation of users

• CWE-346

>=0.2.0, <0.12.0 · fixed in 0.12.0

Origin validation error in JetBrains IntelliJ IDEA

• JetBrains IntelliJ IDEA
• CWE-346

AVEVA System Platform Origin Validation Error

• AVEVA System Platform
• CWE-346

Leaking of user information on Cross-Domain communication in sysend

• Information disclosure
• CWE-346

<1.10.0 · fixed in 1.10.0

Liferay Portal and Liferay DXP fails to check origin of event messages

• CWE-346

<2.0.21 · fixed in 2.0.21

Cookie and header exposure in twisted

• Information disclosure
• CWE-346

>=11.1.0, <22.1.0 · fixed in 22.1.0

Origin validation error in BIG-IP Edge Client for Mac and Windows

• BIG-IP Edge Client for Mac and Windows
• CWE-346

Origin validation error in ZooZ ZEN25 and others

• ZooZ ZEN25
• ZooZ ZEN20
• Denial of service
• CWE-346

Origin Validation Error in Magento 2

• CWE-346

<2.0.33 · fixed in 2.0.33

Elvish vulnerable to remote code execution via the web UI backend

• Information disclosure
• CWE-346

<0.14.0 · fixed in 0.14.0

Remote code execution in Eclipse Theia

• Information disclosure
• CWE-346

>=0.3.9, <1.9.0 · fixed in 1.9.0

Default CORS config allows any origin with credentials

• CWE-346

* · no fixed version yet

XSS vector in slide mode speaker-view

• hedgedoc
• Other injection
• CWE-346

Improper Authorization and Origin Validation Error in OneFuzz

• Broken access control
• CWE-346

>=2.12.0, <2.31.0 · fixed in 2.31.0

Origin Validation Error in Apache Maven

• CWE-346

<3.8.1 · fixed in 3.8.1

Podman Origin Validation Error

• Information disclosure
• CWE-346

<3.0.0 · fixed in 3.0.0