CVE-2021-45457

CVE-2021-45457 (Apache Kylin) is a Cross-Origin Resource Sharing misconfiguration where credentials are allowed from any origin, affecting Kylin 2.x (2.6.6 and earlier), 3.x (3.1.2 and earlier), and 4.x (4.0.0 and earlier). The underlying issue is unsafe handling of cross-origin requests with cre...

in zoujingli/thinkadmin

✍️ Description The application implements a cross-origin resource sharing CORS policy for requests that allows access from any domain. 🕵️‍♂️ Proof of Concept Request GET /data/shop.goods/index.html HTTP/2 Host: testdomain11.com Cookie: lang=zh-cn; PHPSESSID=45780759c5ea6ae0be9cfc95fde04bc9...

USN-4893-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. CVE-2021-23981, CVE-2021-23982, CVE-2021-23983,...

rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names

A flaw was found in rubygem-rack. An attacker may be able to trick a vulnerable application into processing an insecure non-SSL or cross-origin request if they can gain the ability to write arbitrary cookies that are sent to the application. The highest threat from this vulnerability is to data...

CVE-2020-15773

An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user for the duration of the browser session after previously explicitly authenticating with the API...

Cross site scripting

An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user for the duration of the browser session after previously explicitly authenticating with the API...

CVE-2020-15773

The CVE refers to Gradle Enterprise prior to version 2020.2.4, where unrestricted cross-origin requests to read-only data in the Export API allowed an attacker to access a user’s data for the duration of a browser session after authentication. Affected component: Export API data read access due t...

CVE-2020-15773

An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user for the duration of the browser session after previously explicitly authenticating with the API...

Plex Media Server Improper Access Control Vulnerability

Plex Media Server is a set of media player and media server software from the Swiss company Plex. An improper access control vulnerability exists in versions of Plex Media Server prior to 2020-6-15. An attacker could exploit this vulnerability to execute cross-origin application requests via any...

CVE-2020-5742

Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...

CVE-2020-5742

Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...

Improper access control

Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...

Microsoft Edge Information Leakage Vulnerability (CNVD-2020-61592)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An information disclosure vulnerability exists in the way cross-origin requests are handled in Microsoft Edge. An attacker could exploit the vulnerability to determine the source of all w...

CVE-2020-1242

An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge Information Disclosure Vulnerability'...

Information disclosure

An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge Information Disclosure Vulnerability'...

CVE-2020-1242

CVE-2020-1242 is an information-disclosure issue in Microsoft Edge where cross-origin requests are mishandled, enabling an attacker to determine the origin of pages viewed in the affected browser (Edge information leakage). CNVD-2020-61592 documents this vulnerability and OpenVAS KBs reference it...

Microsoft Edge Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests. An attacker who successfully exploited this vulnerability could determine the origin of all webpages in the affected browser. In a web-based attack scenario, an attacker could host a websi...

CVE-2019-20801

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code that accesses a user's data via...

Design/Logic Flaw

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code that accesses a user's data via...

Readdle Documents app authorization control vulnerability

Readdle Documents app is a document manager from Readdle Ukraine. The product supports viewing EPUB eBooks, viewing Word and Excel documents and more. A security vulnerability exists in the iOS-based Readdle Documents app prior to version 6.9.7, which stems from the file transfer web server...