Summary
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
References
Related vulnerabilities
All Supply chain →- MEDIUMGHSA-MX8G-39Q3-5C79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
- HIGHGHSA-J9GF-VW2F-9HRW
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
- MEDIUMGHSA-HHPQ-7WG4-36JM
CakePHP Authentication: Open redirect weakness via backslash bypass
- CRITICALGHSA-8FQ9-273G-6MRG
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
- MEDIUMGHSA-X2QC-CMH9-F4HF
Deno: Denial of service via non-ASCII bytes in WebSocket response headers
- CRITICALGHSA-2F55-G35J-5JMF
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory