CORStest

CORStest 간단한 CORS 설정 오류 스캐너 James Kettle의 연구를 기반으로 함 James Kettle CORStest는 CORSCross-Origin Resource Sharing, CORS 설정 오류를 찾기 위한 빠르고 간단한 Python 3 도구입니다. 도메인 이름 또는 URL 목록이 포함된 텍스트 파일을 입력으로 받습니다. 현재, 특정 Origin 요청 헤더를 보내고 Access-Control-Allow-Origin 응답 헤더를 확인하여 다음과 같은 잠재적 취약점을 탐지합니다: 개발자 백도어: JSFidd...

CVE-2025-55462

CVE-2025-55462 脆弱性の概要 Eramba Community Edition および Enterprise Edition v3.26.0 において、クロスオリジンリソース共有（CORS）の設定ミスが確認されました。このアプリケーションは /system-api/login エンドポイントにおいて、攻撃者が制御する Origin ヘッダーを Access-Control-Allow-Origin レスポンスヘッダーに反映するとともに、Access-Control-Allow-Credentials: true を設定します。...

CVE-2025-34291_cors_security_scanner

CVE-2025-34291corssecurityscanner CORSCross-Origin Resource Sharing 잘못된 구성 감지를 위한 경량 Python 기반 보안 평가 도구 - CVE-2025-34291. CORS 보안 스캐너 위험한 CORSCross-Origin Resource Sharing 잘못된 구성을 탐지하기 위한 경량 Python 기반 보안 평가 도구입니다. 이 도구는 다음을 식별하는 데 도움을 줍니다: - 와일드카드 CORS 정책 - 임의 출처 반영 - 인증 정보가 포함된 CORS 잘못된 구성 - 위험한...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-90882

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

CVE-2026-90882 Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

Origin Validation Error

Overview org.jboss.resteasy:resteasy-core is a JBoss.org project aimed at providing productivity frameworks for developing client and server RESTful applications and services in Java. Affected versions of this package are vulnerable to Origin Validation Error via the response and preflight handli...

UBUNTU-CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

Linux Distros Unpatched Vulnerability : CVE-2026-89058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins , reflects the request's Origin header back in the...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438

This vulnerability exists in Apache Storm 's HTTP components, where three distinct mechanisms allowed web pages from unrelated origins to access authenticated user responses. Specifically, the Logviewer reflected the Origin header in Access-Control-Allow-Origin while sending Access-Control-Allow-...

EUVD-2026-77514

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82291

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

EUVD-2026-67822

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...