CVE-2023-48679: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 Linux, Windows before build 37391...

CVE-2023-30996: Origin Validation Error

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects of different origins. IBM X-Force ID: 254290...

CVE-2024-25124: Origin Validation Error

Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard whil...

CVE-2024-24782 HIMA: Origin Validation Error in multiple products

An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN...

CVE-2024-24782: Origin Validation Error

An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN...

jenkins: cross-site WebSocket hijacking

A flaw was found in Jenkins where websocket access to the CLI does not perform origin validation of requests when they are made through the websocket endpoint...

jenkins: cross-site WebSocket hijacking

A flaw was found in Jenkins where websocket access to the CLI does not perform origin validation of requests when they are made through the websocket endpoint...

jenkins: cross-site WebSocket hijacking

A flaw was found in Jenkins where websocket access to the CLI does not perform origin validation of requests when they are made through the websocket endpoint...

Improper RPKI Origin Validation

github.com/cloudflare/cfrpki is vulnerable to Improper RPKI Origin Validation. The vulnerability is caused by emitting an invalid VRP MaxLength value through validator/lib/roa.go causing RTR sessions to terminate. This flaw allows an attacker disable RPKI Origin Validation which can result in BGP...

Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account

The decentralized social network Mastodon has disclosed a critical security flaw that enables malicious actors to impersonate and take over any account. "Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account," the maintainers said in a...

Origin Validation Error

Google Chrome is vulnerable to Origin Validation Error. The vulnerability is caused due to the Incorrect security UI that can allow a remote attacker to potentially spoof security UI via a crafted HTML page. This can lead to compromising Integrity of the system...

CVE-2024-23832

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

CVE-2024-23832 Mastodon Remote user impersonation and takeover

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

CVE-2024-23832

Mastodon Remote user impersonation and takeover (CVE-2024-23832) affects multiple release lines prior to specific patch levels due to insufficient origin validation when LDAP is used for authentication. Affected components are Mastodon server implementations where LDAP-based authentication can be...

CVE-2024-23832 Mastodon Remote user impersonation and takeover

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

CVE-2024-23832 Mastodon Remote user impersonation and takeover

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

PT-2024-1442 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions prior to 3.5.17 Mastodon versions 4.0.x prior to 4.0.13 Mastodon versions 4.1.x prior to 4.1.13 Mastodon versions 4.2.x prior to 4.2.5 Description: The issue is related to insufficient origin validation in Mastodon, allowing...

BIT-LIFERAY-2022-25146

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

CVE-2024-23898

A flaw was found in Jenkins where websocket access to the CLI does not perform origin validation of requests when they are made through the websocket endpoint...

GHSA-53PH-2R2X-VQW8 Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication...