SAP NetWeaver Process Integration Data Forgery Issue Vulnerability

SAP NetWeaver Process Integration PI is an SAP enterprise application integration software from SAP, Germany, and is a component of the NetWeaver product group. The component is mainly used for the exchange of information between the internal system and the external. A vulnerability exists in SAP...

Microsoft Office Online Server Spoofing Vulnerability

Microsoft Office Online Server is a Web-based office software suite. A spoofing vulnerability exists in Microsoft Office Online Server that originates when Office Online does not properly validate the origin in a cross-domain communication handler. An attacker could exploit this vulnerability by...

CVE-2019-1445: Origin Validation Error

A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447...

PT-2019-3905

Name of the Vulnerable Software and Affected Versions Office Online affected versions not specified Office Online Server affected versions not specified Description A spoofing issue exists due to incorrect validation of origin in cross-origin communications handlers. This can be exploited by a...

CVE-2019-1447: Origin Validation Error

A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1445...

CVE-2019-1442: Origin Validation Error

A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'...

CVE-2019-15020: Origin Validation Error

A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid software update image to the Zingbox Inspector that could result in command injection...

CVE-2019-11777: Origin Validation Error

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information...

CVE-2019-16235: Origin Validation Error

Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280messagecarbons.vala...

CVE-2019-16237: Origin Validation Error

Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313messagearchivemanagement.vala...

CVE-2019-9817: Origin Validation Error

Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird 60.7, Firefox 67, and Firefox ESR 60.7...

CVE-2019-11723: Origin Validation Error

A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...

Flarum Cross-Site Request Forgery Vulnerability

Flarum is an open source forum system. A cross-site request forgery vulnerability exists in Flarum versions prior to 0.1.0-beta.9. The vulnerability stems from a networked system or product that does not adequately validate the origin or authenticity of data, which can be exploited by an attacker...

Advisto PEEL SHOPPING Cross-Site Request Forgery Vulnerability

Advisto PEEL SHOPPING is an open source e-commerce system based on PHP and MySQL. A cross-site request forgery vulnerability exists in Advisto PEEL SHOPPING version 9.0.0. The vulnerability arises from a network system or product that does not adequately validate the origin or authenticity of dat...

Bobronix JEditor editor for Jira cross-site request forgery vulnerability

Bobronix JEditor editor for Jira is a rich text editor for Jira from Bobronix Cyprus. A cross-site request forgery vulnerability exists in Bobronix JEditor editor for Jira versions prior to 3.0.6. The vulnerability stems from a WEB application that does not adequately validate that a request is...

Inateck Technology WP1001 Data Forgery Issue Vulnerability

The Inateck Technology WP1001 is a wireless presentation remote control from Inateck Technology, USA. A vulnerability exists in the Inateck Technology WP1001 v1.3C for data forgery issues. The vulnerability arises from a networked system or product that does not adequately validate the origin or...

Inateck Technology Inateck WP2002 Data Forgery Issue Vulnerability (CNVD-2019-17494)

Inateck Technology The Inateck WP2002 is a wearable wireless presentation remote control from Inateck Technology, USA. A data forgery issue vulnerability exists in the Inateck Technology Inateck WP2002. The vulnerability arises from a networked system or product that does not adequately validate...

Authorization Bypass

icedtea-web is vulnerable to authorization bypass. It was discovered that IcedTea-Web did not properly determine an applet's origin when asking the user if the applet should be run. A malicious page could use this flaw to cause IcedTea-Web to execute the applet without user approval, or confuse t...

CVE-2019-9797: Origin Validation Error

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox 66...

CVE-2019-9803: Origin Validation Error

The Upgrade-Insecure-Requests UIR specification states that if UIR is enabled through Content Security Policy CSP, navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some...