PrivateGPT 安全漏洞

PrivateGPT is an AI project. PrivateGPT has a security vulnerability that stems from a lack of secure session management implementation and a weak CORS policy, resulting in a cross-site request forgery CSRF vulnerability. An attacker could use this vulnerability to trigger a data poisoning attack...

HCL DRYiCE Lucy 安全漏洞

HCL Technologies HCL DRYiCE Lucy is an AI-powered virtual assistant from HCL Technologies, USA. A security vulnerability exists in HCL DRYiCE Lucy that stems from vulnerability to CORS misconfiguration...

Hoppscotch Browser Extension 安全漏洞

Hoppscotch Browser Extension is an open source browser extension for Hoppscotch. A security vulnerability exists in Hoppscotch Browser Extension versions prior to 0.35, which stems from a vulnerability that allows any site running on a browser with the extension installed to bypass CORS...

PT-2024-20105

Name of the Vulnerable Software and Affected Versions vantage6 affected versions not specified Description The vantage6 server has no restrictions on CORS settings, which should be configurable to set allowed origins. The impact is limited because v6 does not use session cookies. Recommendations ...

CVE-2024-28251 Cross-site websocket hijacking in Querybook

Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as for watching the live status of quer...

The vulnerability of an organization’s software for app compatibility with Rack and CORS allows a perpetrator to influence the integrity, confidentiality, and accessibility of information. This vulnerability is related to the improper use of standard permissions.

The vulnerability of an organization’s application compatibility with Rack applications and CORS Rack-cors is related to the improper use of standard permissions. Exploiting this vulnerability can allow attackers to influence the integrity, confidentiality, and accessibility of information...

ceph: RGW crash upon misconfigured CORS rule

A flaw was found in Ceph. Certain misconfigurations of CORS rules in Ceph could result in a significantly large memory allocation. This issue can lead to RGW crashing and a denial of service from an authenticated user on the network...

CVE-2023-50940

IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 275130...

PT-2024-13902 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC affected versions not specified Description: The issue concerns cross-origin resource sharing in IBM PowerSC. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2024-10239 · Ibm · Ibm Devops Velocity +1

Name of the Vulnerable Software and Affected Versions: IBM DevOps Velocity version 5.0.0 IBM UrbanCode Velocity versions 4.0.0 through 4.0.25 Description: The issue is related to the use of an untrusted cross-domain policy file, which could allow a remote attacker to gain unauthorized access to...

CVE-2023-46281

A vulnerability has been identified in Opcenter Execution Foundation All versions V2407, Opcenter Quality All versions V2312, SIMATIC PCS neo All versions V4.1, SINEC NMS All versions V2.0 SP1, Totally Integrated Automation Portal TIA Portal V14 All versions, Totally Integrated Automation Portal...

CVE-2020-10132

SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration...

Envoy 资源管理错误漏洞

Envoy is an open source distributed proxy server. A resource management error vulnerability exists in Envoy that stems from a CORS filter will segment error and crash Envoy...

The vulnerability of the CORS mechanism implementation in Google Chrome browsers allows a hacker to gain access to confidential data.

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to data leaks from various sources. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

go-restful: Authorization Bypass Through User-Controlled Key

A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data...

CVE-2023-22813

A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS...

PT-2023-14617 · Wago · 751-9301 Firmware +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A CORS misconfiguration in the web-based management allows a malicious third-party web server to misuse basic information pages, potentially leading to the disclosure of device...

SUSE CVE-2015-0807

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and...

SUSE CVE-2016-5192

Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages...

SUSE CVE-2017-5408

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox 52, Firefox ESR 45.8, Thunderbird 52, and Thunderbird 45.8...