# CWE-942.

Every Advisory and CVE whose sources give the weakness CWE-942, newest first.

## Records, newest first (an older page)

- [IBM UrbanCode Velocity cross-origin resource sharing](https://agentprime.io/advisories/CVE-2024-22348.md)
  `CVE-2024-22348` · CVE record: IBM UrbanCode Velocity and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 20 Jan 2025 · Tags: CWE-942
- [GHSL-2024-092: Open CORS policy in home-gallery](https://agentprime.io/advisories/CVE-2024-53276.md)
  `CVE-2024-53276` · CVE record: xemle home-gallery · CVSS 6.3 Medium · Not analysed yet · Published 23 Dec 2024 · Tags: CWE-942
- [PlexRipper allows API leak due to open CORS policy](https://agentprime.io/advisories/CVE-2024-49763.md)
  `CVE-2024-49763` · CVE record: PlexRipper PlexRipper · CVSS 8.7 High · Not analysed yet · Published 2 Dec 2024 · Tags: CWE-942
- [IBM Security ReaQta information disclosure](https://agentprime.io/advisories/CVE-2024-45642.md)
  `CVE-2024-45642` · CVE record: IBM Security ReaQta · CVSS 5.3 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-942
- [Insecure Configuration in Gliffy Online](https://agentprime.io/advisories/CVE-2024-10315.md)
  `CVE-2024-10315` · CVE record: Gliffy Gliffy Online · CVSS 6.9 Medium · Not analysed yet · Published 11 Nov 2024 · Tags: CWE-942
- [memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos](https://agentprime.io/advisories/GHSA-p4fx-qf2h-jpmj.md)
  `GHSA-p4fx-qf2h-jpmj`, `CVE-2024-41659`, `GO-2024-3088` · Go `github.com/usememos/memos`: affected `<0.21.0`, fixed in `0.21.0` · CVSS 8.1 High · Not analysed yet · Published 30 Aug 2024 · Tags: CWE-942
- [Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor](https://agentprime.io/advisories/GHSA-mchx-7j67-8mcf.md)
  `GHSA-mchx-7j67-8mcf`, `CVE-2024-41657`, `GO-2024-3087` · Go `github.com/casdoor/casdoor`: affected `*`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 30 Aug 2024 · Tags: CWE-942
- [Arbitrary cross-domain file inclusion in HyperView Geoportal Toolkit](https://agentprime.io/advisories/CVE-2024-6449.md)
  `CVE-2024-6449` · CVE record: HyperView Geoportal Toolkit · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2024 · Tags: CWE-942
- [exacqVision CORS](https://agentprime.io/advisories/CVE-2024-32862.md)
  `CVE-2024-32862` · CVE record: Johnson Controls exacqVision · CVSS 6.8 Medium · Not analysed yet · Published 1 Aug 2024 · Tags: CWE-942
- [SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability.](https://agentprime.io/advisories/CVE-2024-37131.md)
  `CVE-2024-37131` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 7.5 High · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-942
- [HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability](https://agentprime.io/advisories/CVE-2023-37526.md)
  `CVE-2023-37526` · CVE record: HCL Software DRYiCE Lucy · CVSS 6.5 Medium · Not analysed yet · Published 10 May 2024 · Tags: CWE-942
- [Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-38125.md)
  `CVE-2023-38125` · CVE record: Softing edgeAggregator · CVSS 7.5 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-942
- [Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-38122.md)
  `CVE-2023-38122` · CVE record: Inductive Automation Ignition · CVSS 7.2 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-942
- [vantage6's CORS settings overly permissive](https://agentprime.io/advisories/GHSA-4946-85pr-fvxh.md)
  `GHSA-4946-85pr-fvxh`, `CVE-2024-23823`, `PYSEC-2024-326`, `PYSEC-2026-2004` · PyPI `vantage6`: affected `<4.3.0`, fixed in `4.3.0` · CVSS 4.2 Medium · Not analysed yet · Published 15 Mar 2024 · Tags: Broken access control, CWE-942
- [Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials](https://agentprime.io/advisories/GHSA-fmg4-x8pw-hjhg.md)
  `GHSA-fmg4-x8pw-hjhg`, `CVE-2024-25124`, `GO-2024-2574` · Go `github.com/gofiber/fiber/v2`: affected `<2.52.1`, fixed in `2.52.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Feb 2024 · Tags: CWE-346, CWE-942
- [Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains](https://agentprime.io/advisories/CVE-2023-45213.md)
  `CVE-2023-45213` · CVE record: Westermo Lynx · CVSS 6.6 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-942
- [IBM PowerSC cross-resource origin sharing](https://agentprime.io/advisories/CVE-2023-50940.md)
  `CVE-2023-50940` · CVE record: IBM PowerSC · CVSS 5.3 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-942
- [Microsoft Edge for Android Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-21382.md)
  `CVE-2024-21382` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 26 Jan 2024 · Tags: CWE-942
- [Siemens Opcenter Execution Foundation: A vulnerability has been identified in Opcenter Execution Foundation (All versions <…](https://agentprime.io/advisories/CVE-2023-46281.md)
  `CVE-2023-46281` · CVE record: Siemens Opcenter Execution Foundation and 4 more · CVSS 7.1 High · Not analysed yet · Published 12 Dec 2023 · Tags: CWE-942
- [Fortinet FortiDDoS-F: A permissive cross-domain policy with untrusted domains vulnerability in Fortinet…](https://agentprime.io/advisories/CVE-2023-25603.md)
  `CVE-2023-25603` · CVE record: Fortinet FortiDDoS-F and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-942
- [A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1).](https://agentprime.io/advisories/CVE-2023-46098.md)
  `CVE-2023-46098` · CVE record: Siemens SIMATIC PCS neo · CVSS 8.0 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-942
- [Sentry CORS misconfiguration](https://agentprime.io/advisories/GHSA-4xqm-4p72-87h6.md)
  `GHSA-4xqm-4p72-87h6`, `CVE-2023-36829`, `PYSEC-2023-115` · PyPI `sentry`: affected `>=23.6.0, <23.6.2`, fixed in `23.6.2` · CVSS 6.8 Medium · Not analysed yet · Published 6 Jul 2023 · Tags: Broken access control, CWE-697, CWE-942
- [Sensitive information disclosure due to CORS misconfiguration.](https://agentprime.io/advisories/CVE-2023-2360.md)
  `CVE-2023-2360` · CVE record: Acronis Acronis Cyber Infrastructure · CVSS 3.1 Low · Not analysed yet · Published 28 Apr 2023 · Tags: CWE-942
- [Media CP Media Control Panel – Information Disclosure](https://agentprime.io/advisories/CVE-2023-23464.md)
  `CVE-2023-23464` · CVE record: Media CP Media Control Panel · CVSS 8.1 High · Not analysed yet · Published 15 Feb 2023 · Tags: CWE-942
- [Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability.](https://agentprime.io/advisories/CVE-2022-34366.md)
  `CVE-2022-34366` · CVE record: Dell SupportAssist Client Consumer · CVSS 6.5 Medium · Not analysed yet · Published 10 Feb 2023 · Tags: CWE-942
- [Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS).](https://agentprime.io/advisories/CVE-2023-23128.md)
  `CVE-2023-23128` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-942
- [Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).](https://agentprime.io/advisories/CVE-2022-47717.md)
  `CVE-2022-47717` · CVE record · CVSS 7.5 High · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-942
- [Mozilla Thunderbird: A malicious website could have learned the size of a cross-origin resource that supported…](https://agentprime.io/advisories/CVE-2022-31736.md)
  `CVE-2022-31736` · CVE record: Mozilla Thunderbird and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-942
- [HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted](https://agentprime.io/advisories/CVE-2021-27786.md)
  `CVE-2021-27786` · CVE record: HCL Software HCL OneTest Server · CVSS 4.6 Medium · Not analysed yet · Published 7 Jun 2022 · Tags: CWE-942
- [Insecure default value for CORS configuration](https://agentprime.io/advisories/GHSA-g27j-74fp-xfpr.md)
  `GHSA-g27j-74fp-xfpr`, `CVE-2022-26969` · npm `directus`: affected `<9.7.0`, fixed in `9.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Apr 2022 · Tags: CWE-942
- [Remote code execution in Eclipse Theia](https://agentprime.io/advisories/GHSA-v9w2-v7j9-rjpr.md)
  `GHSA-v9w2-v7j9-rjpr`, `CVE-2021-34435` · npm `@theia/mini-browser`: affected `>=0.3.9, <1.9.0`, fixed in `1.9.0` · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2021 · Tags: Information disclosure, CWE-346, CWE-942
- [\[UNKNOWN\] syndesis: It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to…](https://agentprime.io/advisories/CVE-2019-14860.md)
  `CVE-2019-14860` · CVE record: \[UNKNOWN\] syndesis · CVSS 7.4 High · Not analysed yet · Published 8 Nov 2019 · Tags: CWE-942

Newest: <https://agentprime.io/advisories/tag/cwe-942.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-942&cursor=WyIyMDI1LTAyLTA2VDIzOjAwOjExLjAxOTAwMFoiLCJDVkUtMjAyNS0xMDgzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-942/?cursor=WyIyMDI1LTAyLTA2VDIzOjAwOjExLjAxOTAwMFoiLCJDVkUtMjAyNS0xMDgzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.