Permissive Cross-domain Policy with Untrusted Domains

The product uses a cross-domain policy file that includes domains that should not be trusted.

CVEs (112)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-46098 1Siemens 1Simatic Pcs Neo Jun 17, 2026 Nov 14, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker...Show more A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.Show less
CVE-2023-36829 1Functional 1Sentry Jun 17, 2026 Jul 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the...Show more Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.Show less
CVE-2023-2360 1Acronis 1Cyber Infrastructure Jun 17, 2026 Apr 28, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.
CVE-2023-23464 1Mediacp 1Media Control Panel Jun 17, 2026 Feb 15, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.
CVE-2022-34366 1Dell 1Supportassist For Home Pcs Jun 17, 2026 Feb 10, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive informa...Show more Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information. Show less
CVE-2023-23128 1Connectwise 1Connectwise Jun 17, 2026 Feb 1, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and th...Show more Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid.Show less
CVE-2022-47717 1Lastyard 1Last Yard Jun 17, 2026 Feb 1, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
CVE-2022-26969 1Monospace 1Directus Jun 17, 2026 Dec 26, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
CVE-2022-31736 1Mozilla 3Firefox Firefox EsrThunderbird Jun 17, 2026 Dec 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
CVE-2021-27786 1Hcltech 1Onetest Server Jun 17, 2026 Jun 9, 2022 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines t...Show more Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.Show less
CVE-2021-34435 1Eclipse 1Theia Jun 17, 2026 Sep 1, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This...Show more In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..Show less
CVE-2019-14860 1Redhat 2Fuse Syndesis Jun 17, 2026 Nov 8, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized infor...Show more It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.Show less

Previous 1 2 3 4 56