PT-2022-15151 · Nvidia · Nvidia Omniverse Launcher

Name of the Vulnerable Software and Affected Versions: NVIDIA Omniverse Launcher affected versions not specified Description: The issue is related to a Cross-Origin Resource Sharing CORS vulnerability. This vulnerability can allow an unprivileged remote attacker to acquire access tokens, enabling...

The vulnerability of the CORS mechanism implementation in Thunderbird email clients, Firefox browsers, and Firefox ESR browsers allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CORS mechanism implementation in Thunderbird email clients, as well as in Firefox and Firefox ESR browsers, is related to the activation of functions from an unverified controlled area. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain...

DEBIAN-CVE-2021-38019

Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

The vulnerability of the CORS mechanism implementation in Google Chrome browsers allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information through a specially created we...

CVE-2021-22957

A Cross-Origin Resource Sharing CORS vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor who has convinced a privileged user to access a URL with malicious code to take over said user’s account.This vulnerability is fixed in UniFi Protect applicati...

CVE-2021-20432

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344...

CVE-2021-28048

An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-26991

Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing CORS policy which could allow a remote attacker to interact with Cloud Manager...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security. It contains various tools and techniques for exploiting web applications, including a cheat sheet for CSRF injection, a CRLF injection tool, and a proof-of-concept for exploiting CORS misconfiguration. The tools and techniques in...

CVE-2020-26527

An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: ' header...

ceph: radosgw: HTTP header injection via CORS ExposeHeader tag

A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the...

Google Chrome CORS Policy Bypass Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A CORS policy bypass vulnerability exists in versions of Google Chrome prior to 84.0.4147.89, which can be exploited by an attacker to bypass the policy...

PT-2020-14960 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions 3.11 Description: A flaw was found in the way OpenShift Container Platform specified CORS allowed origins during installation, making it too permissive. This could allow an attacker, able to...

CVE-2020-11662

CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access sensitive information...

The vulnerability of the CORS mechanism implementation in Google Chrome browsers stems from insufficient protection of registration data, allowing attackers to gain unauthorized access to information.

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML pa...

Google Chrome Information Disclosure Vulnerability (CNVD-2020-05121)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. An information disclosure vulnerability exists in Google Chrome versions prior to 80.0.3987.87. The vulnerability stems from insufficient policy enforcement of CORS...

PT-2019-17044 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.0 through 11.1 Description: The issue allows overly permissive cross-origin resource sharing, which could enable an attacker to transfer private information. An attacker could exploit this to access content th...

The vulnerability of Blink’s web page display mechanism in Google Chrome browser allows a hacker to gain unauthorized access to protected information.

The vulnerability of Blink’s web page rendering mechanism in Google Chrome relates to bypassing the CORS Cross-origin resource sharing mechanism. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information through a specially created HTML page...

The vulnerability in the implementation of the CORS mechanism for the Google Chrome browser allows a hacker to disclose protected information.

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to disclose protected information through a specially created HTML page...

CVE-2019-19545

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing CORS vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served...