#cwe-942

共收录 81 条相关情报。

← 返回所有主题

漏洞预警2026-07-17 发布INFO

HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domai...

CVE-2024-23578

HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS)

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

安全公告2026-07-17 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow...

CVE-2026-62387

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default C

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-942 #severity:high

漏洞预警2026-07-17 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticat...

CVE-2026-62387

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default C

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

安全公告2026-07-17 发布INFO

Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin

CVE-2026-62387

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default C

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-942

安全公告2026-07-15 发布INFO

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

CVE-2026-53656

### Impact The FiftyOne App/API server (`fiftyone/server/app.py`) and the `/media` route (`fiftyone/server/routes/media

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-346 #cwe-942 #severity:medium

漏洞预警2026-07-15 发布INFO

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/ligh...

CVE-2026-61736

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=*

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

安全公告2026-07-15 发布INFO

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

CVE-2026-61736

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=*

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-942

安全公告2026-07-15 发布INFO

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local us

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-942 #severity:high

漏洞预警2026-07-15 发布INFO

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted ...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local us

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

漏洞预警2026-07-09 发布INFO

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as u...

CVE-2026-59148

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-352 #cwe-732 #cwe-942

安全公告2026-07-09 发布INFO

Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

CVE-2026-59148

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306 #cwe-352 #cwe-732 #cwe-942

漏洞预警2026-07-09 发布INFO

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoi...

CVE-2026-59726

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exp

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-306 #cwe-942

安全公告2026-07-09 发布INFO

Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

CVE-2026-59726

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exp

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306 #cwe-78 #cwe-942

漏洞预警2026-07-09 发布INFO

HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name i...

CVE-2026-56458

HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged action

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

安全公告2026-07-08 发布INFO

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

CVE-2026-53649

# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-306 #cwe-352 #cwe-434 #cwe-942

漏洞预警2026-06-30 发布INFO

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions ...

CVE-2026-12084

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

安全公告2026-06-29 发布INFO

Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration...

CVE-2026-57957

Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unau

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-942 #severity:low

漏洞预警2026-06-29 发布INFO

Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cros...

CVE-2026-57957

Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unau

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

漏洞预警2026-06-26 发布INFO

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-...

CVE-2026-54753

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local H

历史摘要 · 未重新核验 · NVD

#cve #cwe-749 #cwe-942

漏洞预警2026-06-25 发布INFO

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4....

CVE-2026-46608

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s)

历史摘要 · 未重新核验 · NVD

#cve #cwe-183 #cwe-942