1850
Reference Description
CVE-2012-2292 Product has a Silverlight cross-domain policy that does not restrict access to
another application, which allows remote attackers to bypass the Same Origin
Policy.
https://www.cve.org/CVERecord?id=CVE-2012-2292
CVE-2014-2049 The default Flash Cross Domain policies in a product allows remote attackers
to access user files.
https://www.cve.org/CVERecord?id=CVE-2014-2049
CVE-2007-6243 Chain: Adobe Flash Player does not sufficiently restrict the interpretation and
usage of cross-domain policy files, which makes it easier for remote attackers
to conduct cross-domain and cross-site scripting (XSS) attacks.
https://www.cve.org/CVERecord?id=CVE-2007-6243
CVE-2008-4822 Chain: Adobe Flash Player and earlier does not properly interpret policy files,
which allows remote attackers to bypass a non-root domain policy.
https://www.cve.org/CVERecord?id=CVE-2008-4822
CVE-2010-3636 Chain: Adobe Flash Player does not properly handle unspecified encodings
during the parsing of a cross-domain policy file, which allows remote web
servers to bypass intended access restrictions via unknown vectors.
https://www.cve.org/CVERecord?id=CVE-2010-3636
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
References
[REF-943]Apurva Udaykumar. "Setting a crossdomain.xml file for HTTP streaming". 2012
November 9. Adobe. < https://web.archive.org/web/20121124184922/http://www.adobe.com/
devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html >.2023-04-07.
[REF-944]Adobe. "Cross-domain policy for Flash movies". Adobe. < http://kb2.adobe.com/cps/142/
tn_14213.html >.
[REF-945]Microsoft Corporation. "HTTP Communication and Security with Silverlight". < https://
learn.microsoft.com/en-us/previous-versions/windows/silverlight/dotnet-windows-silverlight/
cc838250(v=vs.95)?redirectedfrom=MSDN >.2023-04-07.
[REF-946]Microsoft Corporation. "Network Security Access Restrictions in Silverlight". < https://
learn.microsoft.com/en-us/previous-versions/windows/silverlight/dotnet-windows-silverlight/
cc645032(v=vs.95) >.2023-04-07.
[REF-947]Dongseok Jang, Aishwarya Venkataraman, G. Michael Sawka and Hovav Shacham.
"Analyzing the Crossdomain Policies of Flash Applications". 2011 May. < http://cseweb.ucsd.edu/
~hovav/dist/crossdomain.pdf >.
CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Weakness ID : 943
Structure : Simple
Abstraction : Class
Description
CWE Version 4.14
CWE-943: Improper Neutralization of Special Elements in Data Query Logic
CWE-943: Improper Neutralization of Special Elements in Data Query Logic