GHSA-7RXF-GVFG-47G4 Flask-CORS improper regex path matching vulnerability

corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...

PYSEC-2025-81

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

CVE-2024-8487

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

PT-2025-12108

Name of the Vulnerable Software and Affected Versions feast-dev/feast version 0.40.0 Description A Cross-Origin Resource Sharing CORS issue exists, where the CORS configuration on the agentscope server does not properly restrict access to only trusted origins. This allows any external domain to...

AgentScope 跨站请求伪造漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. AgentScope suffers from a cross-site request forgery vulnerability that stems from the CORS header on the AgentScope Studio backend server being configured too loosely to allow...

Linux Distros Unpatched Vulnerability : CVE-2024-31146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually...

CVE-2022-42447

HCL Compass is vulnerable to Cross-Origin Resource Sharing CORS. This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request...

CVE-2024-22348 IBM UrbanCode Velocity cross-origin resource sharing

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22348 IBM UrbanCode Velocity cross-origin resource sharing

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22348

CVE-2024-22348 concerns IBM UrbanCode Velocity and IBM DevOps Velocity. According to the primary entry and corroborating Red Hat/IBM security notes, the vulnerability stems from Cross‑Origin Resource Sharing (CORS) configurations that do not restrict the domain name to trusted origins. Affected p...

The vulnerability of the Acrobat Reader PDF viewing and editing software is related to synchronization errors when using a common resource, allowing attackers to escalate their privileges.

The vulnerability of the Acrobat Reader PDF viewing and editing software is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

Security Bulletin: IBM DevOps Velocity is vulnerable due to multiple misconfigurations

Summary Multiple vulnerabilities in IBM DevOps Velocity have been address in IBM DevOps Velocity version 5.0.1 Vulnerability Details CVEID:CVE-2024-22348 DESCRIPTION: IBM UCV - UrbanCode Velocity uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions...

CVE-2024-31146

When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually cannot really be guaranteed without knowing internals of any of the involved guests. Therefore such a configuration cannot really be...

DEBIAN-CVE-2024-31146

When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually cannot really be guaranteed without knowing internals of any of the involved guests. Therefore such a configuration cannot really be...

CVE-2024-31146

The Xen hypervisor is affected by CVE-2024-31146 , which involves a security risk when multiple devices share resources and one is passed through to a guest. The underlying issue is that the security of the system and individual guests cannot be guaranteed without knowing the internals of all inv...

Cross-Origin Resource Sharing (CORS) Bypass

github.com/usememos/memos is vulnerable to Cross-Origin Resource Sharing CORS Bypass. The vulnerability is due to a CORS misconfiguration where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true, which may allow an attacker to perform cross-origin requests,...

CVE-2023-37526 HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability

HCL DRYiCE Lucy now AEX is affected by a Cross Origin Resource Sharing CORS vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks...

CVE-2023-37526

The CVE-2023-37526 entry concerns HCL DRYiCE Lucy (now AEX). A CORS misconfiguration in the mobile app could allow unauthorized access to application resources from any web domain and enable cache poisoning, per sources in NVD/CVE records. The root cause is a CORS misconfiguration in the app, wit...

Westermo Lynx 206-F2G Permissive Cross-Domain Security Policy with Untrusted Domains (CVE-2023-45213)

A potential attacker with access to the device would be able to execute malicious code that could affect the correct functioning of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Cross-Origin Resource Sharing (CORS) Bypass

@kindspells/astro-shield is vulnerable to Cross-Origin Resource Sharing CORS Bypass. This vulnerability due to the introduction of valid integrity attributes to injected code and SRI hash added to the generated Content Security Policy CSP header, fooling the browser into believing that the inject...