SUSE CVE-2019-5864

Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension...

SUSE CVE-2021-3524

A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection...

ConnectWise Control 安全漏洞

ConnectWise Control is a self-hosted remote desktop software application from ConnectWise USA. A security vulnerability exists in ConnectWise Control version 22.8.10013.8329, which stems from vulnerability to cross-origin resource sharing CORS attacks...

CVE-2021-38928

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 210323...

PT-2023-12343 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.1.2.1 Description: The issue is related to the use of Cross-Origin Resource Sharing CORS in IBM Sterling B2B Integrator Standard Edition. This could allow an attacker to...

The vulnerability in the implementation of the CORS mechanism in Google Chrome and Microsoft Edge browsers allows a hacker to bypass security restrictions.

The vulnerability of the CORS mechanism implementation in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions through a specially created HTML page...

DEBIAN-CVE-2017-20146

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy...

Directus 安全漏洞

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A security vulnerability exists in Directus versions prior to 9.7.0 that stems from the default setting of CORSORIGIN and CORSENABLED to true...

Google Chrome 注入漏洞

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in Google Chrome, which stems from insufficient untrusted input validation in CORS. An attacker could exploit this vulnerability to bypass security restrictions...

CVE-2022-41294

IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807...

CVE-2022-41294

IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807...

CVE-2022-26137

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability:...

The vulnerability in the implementation of the CORS (Cross-Origin Resource Sharing) mechanism in Firefox browsers, Firefox ESR, and the Thunderbird email client allows a hacker to circumvent security restrictions.

The vulnerability of the CORS Cross-Origin Resource Sharing mechanism implementation in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to the inclusion of functions from an unreliable controlled domain. Exploiting this vulnerability allows a malicious actor to bypass...

The vulnerability in the implementation of the CORS (Cross-Origin Resource Sharing) mechanism in Firefox browsers, Firefox ESR, and the Thunderbird email client allows a perpetrator to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the CORS Cross-Origin Resource Sharing mechanism implementation in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to the inclusion of functions from an unreliable controlled domain during the processing of the Access-Control-Allow-Credentials heade...

CVE-2021-27786

Cross-origin resource sharing CORS enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An...

CVE-2021-27786

Cross-origin resource sharing CORS enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An...

CVE-2022-25227

Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE...

gateway: radosgw: CRLF injection

A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when makin...

PT-2022-3872 · Atlassian · Crowd +6

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 8.0.9 Atlassian Bamboo versions 8.1.0 through 8.1.8 Atlassian Bamboo versions 8.2.0 through 8.2.4 Atlassian Bitbucket versions prior to 7.6.16 Atlassian Bitbucket versions 7.7.0 through 7.17.8 Atlassian...

CVE-2022-21817

NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code...