Vulnerabilities in CORS 1.0