Vulnerabilities in CORS 1.2