344 matches found
CVE-2020-26527
An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: ' header...
ceph: radosgw: HTTP header injection via CORS ExposeHeader tag
A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the...
Google Chrome CORS Policy Bypass Vulnerability
Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A CORS policy bypass vulnerability exists in versions of Google Chrome prior to 84.0.4147.89, which can be exploited by an attacker to bypass the policy...
PT-2020-14960 · Red Hat · Openshift Container Platform
Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions 3.11 Description: A flaw was found in the way OpenShift Container Platform specified CORS allowed origins during installation, making it too permissive. This could allow an attacker, able to...
CVE-2020-11662
CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access sensitive information...
The vulnerability of the CORS mechanism implementation in Google Chrome browsers stems from insufficient protection of registration data, allowing attackers to gain unauthorized access to information.
The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML pa...
Google Chrome Information Disclosure Vulnerability (CNVD-2020-05121)
Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. An information disclosure vulnerability exists in Google Chrome versions prior to 80.0.3987.87. The vulnerability stems from insufficient policy enforcement of CORS...
PT-2019-17044 · Ibm · Ibm Cognos Analytics
Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.0 through 11.1 Description: The issue allows overly permissive cross-origin resource sharing, which could enable an attacker to transfer private information. An attacker could exploit this to access content th...
The vulnerability of Blink’s web page display mechanism in Google Chrome browser allows a hacker to gain unauthorized access to protected information.
The vulnerability of Blink’s web page rendering mechanism in Google Chrome relates to bypassing the CORS Cross-origin resource sharing mechanism. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information through a specially created HTML page...
The vulnerability in the implementation of the CORS mechanism for the Google Chrome browser allows a hacker to disclose protected information.
The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to disclose protected information through a specially created HTML page...
CVE-2019-18381
Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing CORS vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served...
CVE-2019-19545
Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing CORS vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served...
syndesis: default CORS configuration is allow all
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...
CVE-2019-14860
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...
syndesis: default CORS configuration is allow all
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...
The vulnerability of the NPAPI plugin in browsers such as Firefox ESR, Firefox, and the email client Thunderbird allows a hacker to perform cross-site forgery attacks.
The vulnerability of the NPAPI plugin for Firefox ESR, Firefox, and the Thunderbird email client relates to exploiting the Cross-origin Resource Sharing CORS mechanism. Exploiting this vulnerability allows a remote attacker to perform cross-origin requests...
Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...
Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...
UBUNTU-CVE-2019-11712
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...