Permissive Cross-domain Security Policy with Untrusted Domains
CWE-942
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
We track 71 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4.
How this weakness is prevented
- Architecture and Design Operation: Define a restrictive Content Security Policy or cross-domain policy file.
- Architecture and Design Operation: Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
- Architecture and Design Operation: For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
Latest Permissive Cross-domain Security Policy with Untrusted Domains vulnerabilities
- 8.1 High severity
AVideo: Permissive Cross-domain Security Policy with Untrusted Domains
WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origi
- 9.6 Critical severity
qui: Permissive Cross-domain Security Policy with Untrusted Domains
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make aut
- 8.1 High severity
glances: Permissive Cross-domain Security Policy with Untrusted Domains
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of these options
- 7.5 High severity
anything-llm: Permissive Cross-domain Security Policy with Untrusted Domains
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSo
- 9.6 Critical severity
cli: Improper Limitation of a Pathname to a Restricted Directory
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by a
- 7.4 High severity
realtime-collaboration-platform: Origin Validation Error
CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An
- 7.5 High severity
Omada Cloud Controller: Permissive Cross-domain Security Policy with Untrusted Domains
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the af
- 9.0 Critical severity
Altium 365: Improper Access Control
Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScri
- 8.8 High severity
opencode: Missing Authentication for Critical Functionality
OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This v
- 8.1 High severity
Firefox: Permissive Cross-domain Security Policy with Untrusted Domains
Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.
- 8.1 High severity
Firefox: Permissive Cross-domain Security Policy with Untrusted Domains
Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.
- 8.1 High severity
Safari: Permissive Cross-domain Security Policy with Untrusted Domains
The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.
- 8.1 High severity
claude-code-router: Exposure of Sensitive Information to an Unauthorized Actor
claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed t
- 9.8 Critical severity
Concert Software: Incorrect Comparison
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
- 8.1 High severity
paicoding: Origin Validation Error
A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /paicoding-core/src/main/java/com/github/paicoding/forum/core/util/CrossUtil.java
- 7.5 High severity
Omnissa Unified Access Gateway (UAG): Permissive Cross-domain Security Policy with Untrusted Domains
Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.
- 8.8 High severity
DestinyECM: Cross-Site Request Forgery
Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically
- 7.5 High severity
UrbanCode Velocity: Permissive Cross-domain Security Policy with Untrusted Domains
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to onl
- 8.7 High severity
PlexRipper: Permissive Cross-domain Security Policy with Untrusted Domains
PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/Plex
- 8.8 High severity
casdoor: Incorrect Comparison
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logg
- 8.1 High severity
memos: Permissive Cross-domain Security Policy with Untrusted Domains
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-
- 9.8 Critical severity
Secure Connect Gateway (SCG) Policy Manager: Permissive Cross-domain Security Policy with Untrusted Domains
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application
- 8.8 High severity
edgeAggregator: Permissive Cross-domain Security Policy with Untrusted Domains
Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is requir
- 7.2 High severity
Ignition: Permissive Cross-domain Security Policy with Untrusted Domains
Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Although auth
- 9.8 Critical severity
fiber: Origin Validation Error
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-A
- 9.8 Critical severity
PowerSC: Incorrect Comparison
IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 275130.
- 8.8 High severity
Opcenter Execution Foundation: Permissive Cross-domain Security Policy with Untrusted Domains
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal)
- 9.1 Critical severity
FortiDDoS-F: Permissive Cross-domain Security Policy with Untrusted Domains
A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted
- 8.8 High severity
SIMATIC PCS neo: Permissive Cross-domain Security Policy with Untrusted Domains
A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger un
- 7.5 High severity
Acronis Cyber Infrastructure: Permissive Cross-domain Security Policy with Untrusted Domains
Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.
- 9.8 Critical severity
Thunderbird: Permissive Cross-domain Security Policy with Untrusted Domains
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.