Inclusion of Web Functionality from an Untrusted Source
CWE-830
The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
Latest Inclusion of Web Functionality from an Untrusted Source vulnerabilities
- 8.5 High severity
minder: Inclusion of Web Functionality from an Untrusted Source
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which
- 8.0 High severity
open-webui: Improper Neutralization of Directives in Dynamically Evaluated Code
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbit
- 7.8 High severity
Bandizip: Inclusion of Functionality from Untrusted Control Sphere
In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required to exploit this vuln
- 7.8 High severity
PeaZip: Inclusion of Functionality from Untrusted Control Sphere
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in
- 8.3 High severity
brew: Inclusion of Web Functionality from an Untrusted Source
os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandbo
- 8.4 High severity
Firefox: Inclusion of Web Functionality from an Untrusted Source
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerabi
- 8.8 High severity
Remote Management System: Inclusion of Web Functionality from an Untrusted Source
Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cloud proxy. A user can request a web proxy and obtain a URL in the Remote Manageme