CVE-2019-11777: Origin Validation Error

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information...

CVE-2019-11723: Origin Validation Error

A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...

CVE-2019-9817: Origin Validation Error

Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird 60.7, Firefox 67, and Firefox ESR 60.7...

Flarum Cross-Site Request Forgery Vulnerability

Flarum is an open source forum system. A cross-site request forgery vulnerability exists in Flarum versions prior to 0.1.0-beta.9. The vulnerability stems from a networked system or product that does not adequately validate the origin or authenticity of data, which can be exploited by an attacker...

Advisto PEEL SHOPPING Cross-Site Request Forgery Vulnerability

Advisto PEEL SHOPPING is an open source e-commerce system based on PHP and MySQL. A cross-site request forgery vulnerability exists in Advisto PEEL SHOPPING version 9.0.0. The vulnerability arises from a network system or product that does not adequately validate the origin or authenticity of dat...

Bobronix JEditor editor for Jira cross-site request forgery vulnerability

Bobronix JEditor editor for Jira is a rich text editor for Jira from Bobronix Cyprus. A cross-site request forgery vulnerability exists in Bobronix JEditor editor for Jira versions prior to 3.0.6. The vulnerability stems from a WEB application that does not adequately validate that a request is...

Inateck Technology WP1001 Data Forgery Issue Vulnerability

The Inateck Technology WP1001 is a wireless presentation remote control from Inateck Technology, USA. A vulnerability exists in the Inateck Technology WP1001 v1.3C for data forgery issues. The vulnerability arises from a networked system or product that does not adequately validate the origin or...

Inateck Technology Inateck WP2002 Data Forgery Issue Vulnerability (CNVD-2019-17494)

Inateck Technology The Inateck WP2002 is a wearable wireless presentation remote control from Inateck Technology, USA. A data forgery issue vulnerability exists in the Inateck Technology Inateck WP2002. The vulnerability arises from a networked system or product that does not adequately validate...

Authorization Bypass

icedtea-web is vulnerable to authorization bypass. It was discovered that IcedTea-Web did not properly determine an applet's origin when asking the user if the applet should be run. A malicious page could use this flaw to cause IcedTea-Web to execute the applet without user approval, or confuse t...

CVE-2019-9797: Origin Validation Error

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox 66...

CVE-2019-9803: Origin Validation Error

The Upgrade-Insecure-Requests UIR specification states that if UIR is enabled through Content Security Policy CSP, navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some...

CVE-2019-9808: Origin Validation Error

If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission. This...

CVE-2019-3718

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems...

CVE-2019-3718

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems...

Input validation

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems...

CVE-2019-3718

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems...

PT-2019-16663 · Dell · Dell Supportassist Client

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist Client versions prior to 3.2.0.90 Description: The issue concerns an improper origin validation, which could be exploited by an unauthenticated remote attacker to attempt CSRF attacks on users of the impacted systems...

CVE-2019-3718: Cross-Site Request Forgery (CSRF)

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems...

CVE-2019-9498: Origin Validation Error

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication,...

CVE-2019-9499: Origin Validation Error

The implementations of EAP-PWD in wpasupplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection...